Ross Burton [Wed, 5 Aug 2026 16:03:20 +0000 (17:03 +0100)]
glibc: remove obsolete KSHELL assignment
KSHELL was set so that tzselect uses /bin/sh instead of /bin/bash.
This variable doesn't exist in glibc and instead we patch the script in
0019-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch, so we can
remove this assignment.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:59 +0000 (17:57 +0100)]
rust: clean up dependencies
The rust recipe inherits cargo_common which now depends on rust-native
and cargo-native, so we can just remove those dependencies in the native
case instead of having to handle target/nativesdk.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:58 +0000 (17:57 +0100)]
classes/cargo: consolidate dependencies
Move the dependencies from cargo to cargo_common: if cargo is being used
in any way then you need to depend on cargo-native.
Inherit rust instead of rust-common or rust-target-config: rust inherits
rust-common that inherits rust-target-config, and rust.bbclass simply
adds the dependency on rust-native. This means we can drop the explicit
rust dependencies to avoid duplication.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:57 +0000 (17:57 +0100)]
classes/cargo: move general assignments to cargo_common.bbclass
The cargo integration is split into two classes so that recipes can
inherit cargo_common if they can't use cargo directly to build, for
example when using meson+cargo or building rust itself.
However, a number of variables where in cargo.bbclass when they should
really be in cargo_common.bbclass: move the assignments so that the
cargo.bbclass simply inherits cargo_common, sets B, and implements the
compile/install tasks.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:56 +0000 (17:57 +0100)]
classes/rust: remove unused variables
RUSTC_ARCHFLAGS is never passed anywhere, remove it.
RUSTC_BUILD_LDFLAGS is commented out, remove it.
HOST_CFLAGS et al are assigned to the CFLAGS for convenience, but are
not used anywhere and the same values are exported in cargo_common's
oe_cargo_fix_env().
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:55 +0000 (17:57 +0100)]
classes/cargo_common: move PKG_CONFIG_ALLOW_CROSS export to oe_cargo_fix_env
This export is used to tell the pkg-config-rs crate how to behave, so is
only needed at build time. Move the export to oe_cargo_fix_env() along
with the other variables so that the exports are localised and not
global.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 15:44:51 +0000 (16:44 +0100)]
libjpeg-turbo: use system zlib instead of bundled copy
The libjpegturbo library bundles a copy of libspng which in turn bundles
a copy of zlib. We don't currently have a libspng recipe but we can
stop it bundling zlib.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Tue, 4 Aug 2026 06:02:03 +0000 (08:02 +0200)]
devtool: upgrade: ignore changelogs from 3rd party
Some upstream projects bundle vendored dependencies in their source
tree (e.g. nghttp2 ships third-party/mruby, which has its own
NEWS.md). The changelog extractor could mistake one of these
vendored changelogs for the recipe's own, misattributing unrelated
upstream changes to the package being upgraded.
Exclude paths under common vendoring directory names (third-party,
vendor, external, deps, etc.) from changelog candidates.
AI-Generated: Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oeqa/selftest/clang: Add oe-selftests for Clang/LLVM/LLD test suites
Add three selftest classes (LLVMSelfTestSystemEmulated,
ClangSelfTestSystemEmulated, LLDSelfTestSystemEmulated) that run
the upstream LLVM, Clang, and LLD regression test suites on target
using llvm-lit inside QEMU.
Each test:
- Automatically sets CLANG_ENABLE_TESTSUITE = "1" to enable
testsuite CMake flags and target tool installation
- Builds core-image-minimal with Python3 and LLVM dependencies
- Boots QEMU with 8GB RAM / 4 CPUs (3GB for 32-bit ARM)
- NFS-mounts the host TMPDIR into the guest to access build
artifacts (lit configs, test inputs, and target tools)
- Runs llvm-lit with filters to exclude tests for non-target
architectures and unsupported OS platforms
- Excludes known-failing tests specific to each component
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
clang: Enable cmake flags for llvm, clang, lld tests
Enable the necessary CMake flags to build and run tests
for LLVM, Clang and LLD. Install the LLVM target tools
needed to run tests via llvm-lit inside QEMU only when
CLANG_ENABLE_TESTSUITE = "1".
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
clang-tools-extra tests depend on the llvm-bcanalyzer CMake target, which
exists in LLVM's CMake project but is not visible when Clang is built
separately. To run clang tests, disable clang-tools-extra tests for now.
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 3 Aug 2026 09:47:17 +0000 (10:47 +0100)]
classes/setuptools_build_meta: clean the build directory in configure
It's not currently possible to set the build tree to be somewhere we
control, but we know it will always be in the build directory alongside
the setup.py so we can [cleandirs] that.
Essentially the same as the previous patch for the setuptools class[1],
but when using the pep517 class.
[1] oe-core f3854f4f608 ("setuptools3: clean the build directory in configure")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Xiuzhuo Shang [Mon, 3 Aug 2026 03:05:07 +0000 (11:05 +0800)]
bluez5: restrict delta=0 RSSI to proximity filters
When a discovery filter is active (filtered_discovery=true), BlueZ
unconditionally calls device_set_rssi_with_delta(..., delta=0),
causing every BLE advertisement to emit a PropertiesChanged(RSSI)
signal regardless of whether the RSSI value changed.
delta=0 is only needed when a client has expressed explicit proximity
interest by setting an RSSI or pathloss threshold in its discovery
filter. Filters that specify only transport type or UUIDs do not
require per-packet RSSI precision; for those, the standard
RSSI_THRESHOLD=8 rate-limiting is both correct and desirable.
Signed-off-by: Xiuzhuo Shang <xiuzhuo.shang@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
cvelistV5 has correct version identification, so CNA (SUSE) has it
correct, too.
NVD however shows non-existing version 21.2.24 (probably from CVE
description), so it's showing up in reports as unfixed.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The generated meson.cross references the toolchain c/c++ binaries by
bare name (e.g. "aarch64-poky-linux-clang++"), relying on PATH being
set up by the meson wrapper script at build time. Meson stores that
command exactly as configured in compile_commands.json and
meson-info/intro-compilers.json without resolving it to an absolute
path. cpptools (via the mesonbuild extension) resolves compilerPath
using its own process PATH, which does not include the toolchain
directory, and silently falls back to a host compiler, breaking
IntelliSense.
Real builds are unaffected since the wrapper script sets up PATH at
build time, so leave the recipe's meson.cross untouched. Instead,
layer an extra --cross-file on top that only absolutizes the c/cpp
[binaries] entries, reusing the exact same flags as CC/CXX to avoid
any behavior drift. Meson merges multiple machine files, with later
files overriding matching keys from earlier ones.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
devtool: ide-sdk: fix $@ overwritten by set in install_and_deploy script
The generated install_and_deploy shell script uses 'set $BUILDDIR $BITBAKEDIR'
to pass arguments to oe-init-build-env. This overwrites $@, so the original
command-line arguments (e.g. -t user@host -P 2222) are lost before the
embedded deploy script can read them.
Save the original arguments in $_args before the 'set' call and pass
$_args to the deploy script instead of $@.
Extend the argument-parsing loop in the embedded Python deploy script to
handle -P/--port in addition to -t/--target, so that non-default SSH
ports are forwarded to devtool deploy-target.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
devtool: ide-sdk: fix duplicate -p flag in _target_ssh_args
ssh_port is stored as ['-p', '<port>'] (already includes the flag).
_target_ssh_args was wrapping it in another list with a leading "-p",
producing invalid ssh args like ["-p", ["-p", "2222"]].
Extend ssh_args directly with ssh_port instead of nesting it.
Also pass --port to the install-and-deploy task in the generated VS Code
configuration so the task reaches the target on non-default SSH ports.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 20:18:21 +0000 (21:18 +0100)]
libunwind: Disable cxx exceptions for riscv64
With the newer libtool, libunwind fails to build on riscv64 with an error
about the WCClinker option. Disable those exceptions until a better fix
is identified.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Markus Volk [Mon, 3 Aug 2026 13:49:15 +0000 (15:49 +0200)]
libva: update 2.23.0 -> 2.24.1
version 2.24.1
va: include <unistd.h> for getuid/getgid in secure_getenv fallback
version 2.24.0
va: Add VA_PICTURE_H264_NON_EXISTING flag
va: use secure_getenv instead of getenv in va_x11.c
doc: fix libva av1 link for doxygen
trace: dump input/output data in va_TraceProtectedSessionExecute
trace: Add ProtectedSession Related Log in Trace
Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Mon, 3 Aug 2026 23:26:41 +0000 (16:26 -0700)]
Revert "python3-websockets: enable ptest"
The tests/ are no longer packaged in the sdist and this is intentional:
https://github.com/python-websockets/websockets/issues/1739#issuecomment-5016084799
"You mustn’t rely on the git repository as input. Specifically, you
mustn’t attempt to run the main test suite. It isn’t treated as a
deliverable of the project. It doesn’t do what you think it does. It’s
designed for the needs of developers, not packagers.
On a typical build farm for a distribution, tests that exercise timeouts
will fail randomly. Indeed, the test suite is optimized for running very
fast, with a tolerable level of flakiness, on a high-end laptop without
noisy neighbors. This isn’t your context."
* Restored compatibility of serve_forever() in the asyncio implementation
with third-party event loops such as uvloop.
* Prevented the Trio implementation from crashing when backpressure kicks
in, i.e. when receiving data faster than the application can process it.
* websockets 17.0 requires Python ≥ 3.11.
- websockets 16.1 is the last version supporting Python 3.10.
* Aliases for modules moved or deprecated in 9.0 are removed.
- See the changelog of version 9.0 for details.
* process_request may receive requests using an HTTP method other than
GET or using the HTTP/1.0 protocol.
- Previously, the server closed the connection without returning an HTTP
response. Now, process_request runs and can return an HTTP response.
* Several boolean arguments are now keyword-only.
- If you were passing some of the following as positional arguments, you
must update your code to pass them as keyword arguments.
* send(text=...)
* ping(ack_on_close=...)
* broadcast(raise_exceptions=...)
* Encoding and decoding non-ASCII headers in handshake requests and
responses changed.
- The previous behavior was undocumented, inconsistent, and didn’t match
the HTTP specification. If you relied on the encoding being UTF-8 or
ASCII with surrogate escapes, depending on the context, you must
switch to ISO-8859-1.
* In the threading implementation, the socket argument is renamed to sock.
- The first argument of ClientConnection and ServerConnection is renamed
from socket to sock for consistency with connect() and serve(). The
first argument of Server is also renamed. If you’re passing it as a
keyword argument, you must change your code.
New features
------------
* websockets 17.0 introduces a trio implementation.
- It is an alternative to the asyncio implementation.
- See websockets.trio.client.connect()
and websockets.trio.server.serve() for details.
* Validated compatibility with Python 3.15.
* Added broadcast() to the threading implementation.
* Made the set of active connections available in the Server.connections
property in the threading implementation.
* Closed connections when shutting down the server in the threading
implementation. See shutdown() for details.
* Added the --insecure option to the websockets CLI to disable TLS
certificate validation.
Improvements
------------
* Supported non-ASCII headers consistently in handshake requests and
responses, using ISO-8859-1 encoding.
* Replied with HTTP 405 Method Not Allowed when the handshake request
doesn’t use the GET method, and with HTTP 505 HTTP Version Not
Supported when it doesn’t use HTTP/1.1, instead of closing the
connection.
* Replied with HTTP 414 URI Too Long or 431 Request Header Fields Too
Large when the handshake request exceeds a security limit, instead of
closing the connection.
* Reduced noise in server logs when clients fail to establish a
connection.
* Clarified logs when process_request sends a plain HTTP response, without
attempting to open a WebSocket connection.
* Added the reconnect_delays argument for customizing the delays between
reconnection attempts in connect(), beyond existing WEBSOCKETS_BACKOFF_*
environment variables.
* Added wheels for Windows ARM64 and Linux i686.
Bug fixes
---------
* Restored compatibility of the websockets CLI with Windows.
* Fixed serve_forever() in the asyncio implementation so that canceling
it always closes connections gracefully.
* Fixed a bug that could delay or block the client in the threading
implementation on macOS when the opening handshake fails.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Mon, 3 Aug 2026 23:26:39 +0000 (16:26 -0700)]
python3-uv-build: upgrade 0.11.32 -> 0.12.1
No changes to uv-build in git, just tags.
The uv_build package is built from the uv/crates/uv-build
directory.
git log --oneline 0.11.32..0.12.1 crates/uv-build
329541a50 (tag: 0.12.1) Bump version to 0.12.1 (#20867) 43a128899 Bump version to 0.12.0 (#20775) fece32fc5 (tag: 0.11.33) Bump version to 0.11.33 (#20764)
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
50.0.0 - 2026-07-31
SECURITY ISSUE: pkcs7_decrypt_der() and its PEM and S/MIME variants no
longer expose distinguishable errors or timing when unwrapping a
RecipientInfo’s encryptedKey, which could act as a Bleichenbacher oracle
for callers that decrypt untrusted messages. A random key is now
substituted on failure, as described in RFC 3218. Credit to X1AOxiang
for reporting the issue
Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
Added xof() class methods to SHAKE128 and SHAKE256 for constructing
algorithm instances configured for use with XOFHash.
The X.509 verification APIs are now considered stable and are subject to
our API stability policy.
Added the Cobblestone (streaming symmetric encryption) recipe, an
implementation of the Cobblestone-128 and Cobblestone-256 instantiations
of the C2SP chunked-encryption specification for streaming authenticated
encryption of large messages.
Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead
of silently ignoring them.
Added support for using Name as a field type in the ASN.1 module.
Loading a public key or an EC private key now rejects DER where the
subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number
of unused bits, instead of silently ignoring it.
Parsing a CRL entry’s InvalidityDate extension now rejects a
GeneralizedTime that carries fractional seconds or another non-DER form,
matching the strict encoding already required for every other X.509 time
field.
load_der_ocsp_request() and load_der_ocsp_response() now reject a request
or response whose version field is not v1, the only version defined by
RFC 6960, matching the version validation already performed when loading
certificates, CSRs and CRLs.
XOFHash is now supported when building against AWS-LC.
HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
building against AWS-LC.
Diffie-Hellman (Diffie-Hellman key exchange) is now supported when
building against AWS-LC.
load_der_public_key() and load_pem_public_key() now reject Diffie-Hellman
public keys whose modulus is smaller than 512 bits, matching the minimum
already enforced when loading DH private keys and when constructing
DHParameterNumbers.
Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message
representative) used by the external-mu signing and verification APIs.
The builtin HashAlgorithm classes and the classes in padding can now be
compared with ==.
CertificateBuilder now supports creating unsigned certificates (RFC 9925)
with the create_unsigned method.
The X.509 verification APIs now permit ML-DSA-44, ML-DSA-65, and ML-DSA-87
(RFC 9881) public keys and signatures by default.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 3 Aug 2026 11:28:41 +0000 (12:28 +0100)]
ruby: upgrade 4.0.5 -> 4.0.6
Bug fixes only, upstream release notes:
- Thread.each_caller_location(1, 1) segfaults when called from a cfunc
- heap-use-after-free in rb_vm_ci_lookup under parallel Ractors
- defined? returns nil for protected methods defined in a module even when callable
- [BUG] should have cvar cache entry
- YJIT misaligns locals when there are > 256 local variables
- GC compaction breaks compare-by-identity sets
- invokesuper from define_method in Ractor can call wrong super method or crash
- Array#sum takes slow path, does not perform compensated summation of Float elements when init argument is a Float
- Float#round(n) returns a wrong result when n is big
- Float#ceil gives incorrect result
- Freeing a mutex locked by a fiber inside fiber scheduler can crash
- Crash when modifying instance variables during inspect or Marshal dump
- ASAN heap-use-after-free in rb_data_free after TypedData dfree frees dynamic rb_data_type_t
- Constant-folded /o regexp crashes with dupstring of a Regexp
- $! stays as the first exception in Ruby Box
- Split the root box into the (newer) root box and the master of copied user boxes
- Segfault caused by ar_find_entry_hint() not checking for conversion to st_table
- error_highlight raises NotImplementedError for ArgumentErrors that get wrapped
- Inconsistencies in type coercion error messages for integers
- IO::Buffer#locked leaves the buffer locked when the block raises
- parse.y regexp crash on invalid encoding
- Stack underflow for partial DCE and loops
- void value missed in parse.y
- Segfault in PRISM while Bootsnap compiles aws-sdk client_api.rb
- Unnecessary context-switching, especially bad on multi-core machines.
- Keyword-only method silently accepts a positional argument
- parse.y interpolation inside lambda literal
- SEGV in branch peephole optimization due to label/insn struct aliasing
- Ruby's default SIGINT handling ignores Thread.handle_interrupt masking.
- Enumerator::Lazy#to_enum does not accept method names as strings
- Signal.trap(:EXIT) exception only shown if at_exit also raises
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 3 Aug 2026 11:28:40 +0000 (12:28 +0100)]
mesa-demos: upgrade to latest revision
- meson: Do not pass multiple dependencies in one dependency call
- eglinfo: support EXT_device_query_name and EXT_device_persistent_id
- eglinfo: move brief mode check into PrintDeviceExtensions()
- util: add a utility function for UUID printing
- eglinfo: fix doExtExplicitDevice() control flow
- eglinfo: fix querying of platforms with explicit devices
- eglinfo: add ability to show only device platforms
- eglinfo: allow platform selection for explicit devices
- vulkan: modernize vk_layer_settings.txt
- vkgears: check for errors while waiting for fences
- vkgears: specify one-time-submit
- vkgears: destroy dsl after updating ds
- vkgears: barrier to transfer-write
- eglut/wsi/wayland: remove a debug fprintf()
- vulkan/wsi/wayland: mirror the libdecor changes in eglut/wayland
- eglut/wayland: Don't leak libdecor frame
- eglut/wayland: Move libdecor context to display struct
- eglut/wayland: Don't finish display when dispatching
- eglut/wsi/wayland: Dispatch wl_display via libdecor
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
v2.1.1
======
* Minimize internal Python API usage for interpreter and thread state
sampling where possible. Avoids breaking ABI change in
Python >= 3.15.0b4. (#269)
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Leon Anavi [Mon, 3 Aug 2026 10:52:35 +0000 (13:52 +0300)]
python3-numpy: Upgrade 2.5.0 -> 2.5.1
Upgrade to release 2.5.1:
- The minimum supported GCC version has been updated from 9.3.0 to
10.3.0
- Bug fixes
Drop 0001-python-sysroot.patch because the vendored fork of Meson
in numpy has been upgraded to include patches from 1.12.0rc2,
including the specific sysroot fix available since since 1.10.0.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Collect a config error instead of raising a raw `TypeError` when
`project.dynamic` contains a non-string (unhashable) entry with
`all_errors=True`.
Features:
- Support [PEP 808](https://peps.python.org/pep-0808/) (partially dynamic
project metadata) (METADATA 2.6).
- Add support for Python 3.15.
- Warn ([PEP 685](https://peps.python.org/pep-0685/)) when an extra name in
`project.optional-dependencies` is not a valid name. The extra is still
emitted, only a `ConfigurationWarning` is produced.
Fixes:
- Error on an unset dynamic version instead of silently writing
`Version: 0.0.0`. If `"version"` is declared in `project.dynamic` but never
assigned by the build backend, writing the metadata now raises a
`ConfigurationError` (`Field "project.version" missing`), restoring the 0.8.x
behavior that regressed in the 0.9 rewrite.
- Don't crash on a non-table `[project]` when `all_errors=True`.
- Tighten `license-files` glob checks and private-tag parsing.
- Handle braces in user data within error messages.
- Correct the `Import-Namespace` field name in the metadata mapping.
- Fix UTF-8 author and maintainer names.
Performance:
- Cache `get_type_hints` and precompile dispatch patterns.
Documentation:
- Fix a stale dynamic docstring and a broken module example.
- Add a documentation project URL.
Internal and CI:
- Refactoring: consistent dataclass decorators, sorted constant entries, and
removal of duplicate imports and dead code.
- Cover defensive branches in dispatch helpers and validators.
- Secure GitHub Actions workflows and bump pinned/downstream dependencies.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 06:15:42 +0000 (06:15 +0000)]
libadwaita: upgrade 1.9.2 -> 1.9.3
=============
Version 1.9.3
=============
- AdwAboutDialog
- Fix a bug with deselecting text in the legal section
- AdwSidebar
- Fix item suffixes ending up after the arrow in page mode
- AdwTabOverview
- Make sure we don't round corners in adaptive preview
- AdwWindow/AdwApplicationWindow
- Fix false minimum size warnings in adaptive preview
- Translation updates
- Norwegian Bokmål
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 11:54:02 +0000 (12:54 +0100)]
xmodmap: Upgrade 1.0.11 -> 1.0.12
Changes:
- xmodmap 1.0.12
- meson: include headers when checking for functions
- meson: Add option to build with meson
- handle.c: handle -Wuse-after-free warning from gcc 15
- gitlab CI: drop the ci-fairy check-mr job
- parse_keysym: handle possible NULL return from copy_to_scratch()
- Strip trailing whitespace from source files
- xmodmap.1: Some editorial changes for this man page [Debian bug #1094313]
- Improve man page text & formatting
- Accept --help & --version as aliases to -help & -version
- Use _strnicmp() instead of strncasecmp() on Windows
- Assume target platforms have strncasecmp now
- Remove "All rights reserved" from Oracle copyright notices
- gitlab CI: stop requiring Signed-off-by in commits
License-Update: Copyright line removal of "all rights reserved"
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 11:22:19 +0000 (12:22 +0100)]
xwininfo: Upgrade 1.1.6 -> 1.1.7
Changes:
- xwininfo 1.1.7
- meson: include headers when checking for functions
- meson: Add option to build with meson
- configure: remove local copy of config.rpath
- gitlab CI: drop the ci-fairy check-mr job
- Use stdbool.h
- Fix memory leak in Select_Window
- Fix memory leak in Display_Window_Id
- man page: fix warnings from `mandoc -T lint` and `groff -rCHECKSTYLE=10`
- Improve man page formatting
- Accept --help & --version as aliases to -help & -version
- -help should exit(0) not (1)
- Update xwininfo.man for #2
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 10:35:59 +0000 (11:35 +0100)]
xvinfo: Upgrade 1.1.5 -> 1.1.6
Changes:
- meson: Add option to build with meson
- gitlab CI: drop the ci-fairy check-mr job
- man page: fix warnings from `mandoc -T lint` and `groff -rCHECKSTYLE=10`
- Accept --help & --version as aliases to -help & -version
- Add -help option
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Wang Mingyu [Tue, 4 Aug 2026 04:05:07 +0000 (12:05 +0800)]
taglib: upgrade 2.3 -> 2.3.1
Changelog:
==========
* Matroska: Fix crash when seek head is invalid or missing.
* Matroska: Check element length, support unknown size length, skip invalid
elements.
* Matroska: Allow Chapters without a ChapterUID.
* Fix data length indicator check for compressed ID3v2 frames.
* MP4: Use 'LongLong' instead of 'UInt' for 'cnID' atom to support large
catalog IDs.
* MP4: Fix destructor and assignment operator for 'MP4::Chapter'.
* MP4: Let 'hasiXMLData()', 'hasBEXTData()' track on-disk state rather than
in-memory state.
* MP4: Support NI STEM atoms with 64-bit length.
* MP4: Enlarge limit number of MP4 atoms at top level.
* MP4: Avoid excessive sample allocations with invalid 'stsc' for QT chapters.
* XM: Correctly save XM tracker files with samples.
Signed-off-by: Wang Mingyu <wangmy@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adam Blank [Sat, 18 Jul 2026 13:25:12 +0000 (15:25 +0200)]
bitbake.conf: remove 'extend_recipe_sysroot' from BB_HASHEXCLUDE_COMMON
'extend_recipe_sysroot' can and should be handled just like any other
function. Fine grained use of 'vardepsexclude' is capable of achieving
the same effect as ingoring 'extend_recipe_sysroot' on the base hash
level, but with a better visibility, and is a more uniform approach.
Signed-off-by: Adam Blank <adam.blank.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Adam Blank [Sat, 18 Jul 2026 13:25:07 +0000 (15:25 +0200)]
staging: add 'extend_recipe_sysroot' to 'vardepsexclude'
'do_prepare_recipe_sysroot' did not declare this explicitly,
but made use of the fact, that 'extend_recipe_sysroot' is
ignored on the base hash level.
Also for cached tasks, when prepending them with
'extend_recipe_sysroot', exclude it from their signatures.
Signed-off-by: Adam Blank <adam.blank.g@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 11:41:34 +0000 (12:41 +0100)]
u-boot: always use GCC to build
Previously, u-boot was almost always built with GCC because the
kernel-arch inherit set TOOLCHAIN to KERNEL_TOOLCHAIN, which defaulted
to 'gcc'.
However, since kernel-arch inherit was removed, u-boot in theory now
respects the default toolchain. In practise, the recipe hard-codes CC
to be gcc, and there are known caveats building u-boot with clang[2].
In the long term we should be able to make this recipe respect TOOLCHAIN,
as the upstream u-boot CI does build and test with clang, but for now
fix the build by restoring the explicit use of gcc.
[1] oe-core 8fb5470841b ("u-boot: Separate out from kernel-arch.bbclass")
[2] https://docs.u-boot-project.org/en/latest/build/clang.html
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
useradd.bbclass: drop groupmems from sysroot setup
groupmems was removed from shadow 4.20.0 [1]. The useradd class never
actually called the binary - perform_groupmems already uses usermod.
Drop it from the sysroot loop to silence the warnings.
Notable upstream changes:
- expiry(1): removed (deprecated in 4.19)
- groupmems(8): removed, use usermod(8) instead (deprecated in 4.19)
- logoutd(8): removed (deprecated in 4.19)
- PAM configs for setuid account tools removed (08f27babeb2c)
- login.defs(5): ENCRYPT_METHOD now defaults to SHA512
- Removed unused dependency on libattr
- New --disable-syslog configure option
Patches removed:
- prototypes.patch: patched src/expiry.c and src/logoutd.c which were
removed upstream in commits 2bb1b984 and eec97ce4.
- disable_syslog.patch: shadow now supports --disable-syslog configure
option natively. Added to EXTRA_OECONF for class-native instead.
- shadow-update-pam-conf.patch: the files it patched (chgpasswd,
groupadd, groupdel, groupmod, useradd, userdel, usermod) were removed
upstream in commit 08f27babeb2c. The remaining pam.d files in the
tarball are all overridden by the recipe's own PAM files.
Patches added:
- 0001-subid-Add-stdint.h-for-uintmax_t.patch: backport of upstream
commit ba4419c57b22 fixing missing <stdint.h> include causing build
failure in find_new_sub_uids.c and find_new_sub_gids.c.
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sun, 2 Aug 2026 07:36:57 +0000 (08:36 +0100)]
lib/oe/lsb: Merge distro_identifier functions
In order to access LSB_DISTRO_ADJUST fuctions, a portion of the lsb
distro_indetifier code was left in base.bbclass. There is a way to handle
this so merge the code into one function and use it from all call
sites.
This makes the code slightly less of a maze.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 18:00:30 +0000 (19:00 +0100)]
kernel-devicetree: Add missing function prefixes
There is an implicit ordering problem with this class and kernel.bbclass,
since kernel.bbclass uses EXPORT_FUNCTIONS on these function and if the
inherit ordering is wrong, the functions get broken.
The class is always included and always wants to append them. Therefore
target the real functions we want to change.
This makes the inherit order less fragile.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 1 Aug 2026 12:51:16 +0000 (13:51 +0100)]
kernel-arch: Move ARCH usage into target classes
Since ARCH is just a function now we can move it into the target class usages
and drop it from the default environment. We still have to export in some
cases where the usage is unknown but this does significatly reduce the
scope and number of places exported to.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 31 Jul 2026 10:39:21 +0000 (11:39 +0100)]
barebox: Separate out from kernel-arch.bbclass
Move the ARCH usage into barebox.bbclass and stop using kernel-arch.bbclass
since there are things in there which barebox might not want.
This does mean the variables ARCH and UBOOT_ARCH are no longer in the environment
but I hopefully covered the main usages of the variables with alternatives.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 31 Jul 2026 10:34:58 +0000 (11:34 +0100)]
u-boot: Separate out from kernel-arch.bbclass
Move the UBOOT_ARCH usage into u-boot.inc and stop using kernel-arch.bbclass
since there are things in there which u-boot might not want.
This does mean the ARCH and UBOOT_ARCH variables are no longer in the environment
but I hopefully covered the main uboot usages of the variables.
Also document where these values are from and what they're supposed to mean
explictly, including the difference between UBOOT_ARCH and UBOOT_ARCH_DIR.
UBOOT_ARCH_DIR has issues which will need discussion with newer platforms
which use dts/upstream.
You might think we need to set ARCH in EXTRA_OEMAKE for u-boot but it turns
out it was ignoring the value and setting it breaks builds. This patch
therefore doesn't do that after confirmation from the u-boot devs:
Richard Purdie [Wed, 29 Jul 2026 22:32:52 +0000 (23:32 +0100)]
kernel-arch: Move kernel and uboot arch functions to lib/oe/kernel.py
Move the ARCH and UBOOT_ARCH python functions to the python library code.
The ability to alter valid_archs is removed as:
- the values should be long since established by now
- non-linux targets have an escape in the code
- the lower case variable name is not normal convention and should be
replaced if we were to retain it
By removing it we'll find out if anyone does actually need that (and we
can probably fix the entries in the file if there is anything missing).
The code itself is full of redundant codepaths but that is for another
patch if we try and improve it.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 21:39:29 +0000 (22:39 +0100)]
lib/oe/kernel: Move python functions from linux-kernel-base to library code
This means get_kernelXXX needs to become oe.kernel.get_XXX and means we can
clear linux-kernel-base to allow it to be removed, starting to simplify the
file structure.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Wed, 29 Jul 2026 22:46:53 +0000 (23:46 +0100)]
sstatesig: Use kernel.bbclass instead of linux-kernel-base.bbclass
linux-kernel-base is nearly empty and about to be removed, switch to
kernel.bbclass which should be similar. The main risk is other layers
using that class name, but hopefully they'd still be kernels!
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:22 +0000 (14:25 +0200)]
perl: inherit upstream-stable-release-point
perlpolicy documents a strict maintenance-branch policy: new releases of
a maint branch may only contain security/CVE fixes, crashing bugs,
regressions, build and install blockers, portability fixes and factual
documentation corrections, and must not contain patches that "add or
remove features", "break binary compatibility", or "add new warnings or
errors or deprecate features". New dual-life module versions are
explicitly deferred to the next stable series. So upgrades within a
major.minor are stable point upgrades per the OE-Core stable release
policy (ref-manual, "Stable Point Release Upgrades"). Long-lived
per-even-minor maint branches back this up, maint-5.6 through maint-5.42,
with a documented back-porting vote process.
Checked the last two point releases for feature creep. perldelta makes
this easy to see, as maint releases carry no "Core Enhancements" section
at all:
5.42.2 (Mar 29 2026): one CVE in a vendored dependency, CVE-2026-4176
in Compress::Raw::Zlib, plus module version bumps. States "There are no
changes intentionally incompatible with 5.42.1".
5.42.1 (Mar 08 2026): four fixes -- a Configure fix so POSIX locale
values can be passed in for cross-compilation, an AIX thread-safe
locale workaround, a Win32 build fix, and module version bumps. States
"There are no changes intentionally incompatible with Perl 5.42.0".
5.42.0 (Jul 02 2025) is the series-opening release, not a point
release: it adds seven language-level features, confirming X.Y.0 bumps
are feature bumps that must stay outside the regex.
Cross-checked the previous series the same way: 5.40.1, 5.40.2 and 5.40.3
all show the same profile, with security, module, documentation, test and
bug-fix sections only and no Core Enhancements.
The policy forbidding binary-compatibility breaks in maint releases also
covers the ABI concern directly.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 5.34.1 -> 5.34.3 and
scarthgap 5.38.2 -> 5.38.4 are both in-series point bumps. wrynose is
still at 5.42.0 while master is at 5.42.2, so it is missing the
CVE-2026-4176 fix -- exactly the tracking gap --stable is meant to close.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:21 +0000 (14:25 +0200)]
git: inherit upstream-stable-release-point
Git's maintainer documentation defines the version scheme explicitly:
vX.Y.0 are feature releases carrying bugfixes and enhancements in any
area, while vX.Y.Z (Z>0) maintenance releases "contain only bugfixes for
the corresponding vX.Y.0 feature release and earlier maintenance
releases". So upgrades within a major.minor are stable point upgrades per
the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades").
Checked recent maintenance releases for feature creep:
2.44.4 (May 28 2025): CVE fixes only, seven of them, merged up from the
fixes that appeared in v2.43.7. The release notes contain nothing else.
2.35.7 (Feb 06 2023): four fixes -- two libcurl portability fixes, and
two symlink-escape fixes in apply and clone back-merged from older
maintenance lines.
No 2.55.x point release exists yet, 2.55.0 being the current tip, so this
relies on the documented policy plus the historical pattern above rather
than a same-series point release. The ref-manual admits that basis: a
recipe may qualify on clear historical evidence that a class of bump is
bugfix-only (ref-manual, "Criteria for Qualifying Upstreams").
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 2.35.2 -> 2.35.7,
five point bumps, and scarthgap 2.44.0 -> 2.44.4, three point bumps.
wrynose ships 2.53.0 as its initial version with no bump yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:20 +0000 (14:25 +0200)]
xz: inherit upstream-stable-release-point
XZ Utils's README documents that an even minor (Y) is a stable series
where the revision (Z) "is incremented when bugs get fixed without adding
any new features". So upgrades within a major.minor are stable point
upgrades per the OE-Core stable release policy (ref-manual, "Stable Point
Release Upgrades").
Checked the last two point releases for feature creep:
5.8.3 (Mar 31 2026): one CVE (CVE-2026-34743, a buffer overflow in
lzma_index_append), one invalid-memory-access fix, build portability
fixes for Windows ARM64EC and Hurd, and man page translations. No new
options or API.
5.8.2 (Dec 17 2025): build portability fixes for four toolchains, a
RHEL 9 kernel-bug workaround, and a resource-aware memory-limit default
tweak that is a bugfix rather than a new feature. No new options or
API.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone picked up 5.2.6 and
scarthgap 5.4.7, one bump each.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:19 +0000 (14:25 +0200)]
dbus: inherit upstream-stable-release-point
D-Bus's CONTRIBUTING.md documents even-minor stable branches, currently
dbus-1.16.x, that receive only cherry-picked bug fixes, so upgrades
within a major.minor are stable point upgrades per the OE-Core stable
release policy (ref-manual, "Stable Point Release Upgrades"). It also
states that odd-minor development branches such as 1.17.x are not
supported at all and receive no bug fixes, not even for security
vulnerabilities, so only the even-minor stable series should be tracked.
Checked the only point release in the series so far for feature creep,
the 1.16.x series having just one non-.0 release to date:
1.16.2 (Feb 27 2025): two items -- one build-regression fix for
verbose-mode builds against libselinux >= 3.8, and a documentation
update. No API or behaviour changes.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 1.14.0 -> 1.14.8.
scarthgap has had zero point-release bumps since its fork and remains at
1.14.10; wrynose ships 1.16.2 as its initial version with no bump yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:18 +0000 (14:25 +0200)]
glib-2.0: inherit upstream-stable-release-point
GLib's docs/backports.md states that only bug and documentation fixes are
backported to the current stable branch, that new features and API/ABI
changes must not be, and that micro stable releases are intended as
drop-in replacements. So upgrades within a major.minor are stable point
upgrades per the OE-Core stable release policy (ref-manual, "Stable Point
Release Upgrades").
Checked the last two point releases for feature creep:
2.88.2 (Jun 25 2026): entirely "Bugs fixed" backports plus translation
updates.
2.88.1 (May 02 2026): seven fixes -- a GCC 16 miscompilation, a GRegex
out-of-bounds read with security impact, and five further out-of-bounds
reads. No API or behaviour changes.
The series opened with 2.88.0 (Mar 16 2026), which must stay outside the
regex as the feature-level release.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 2.72.0 -> 2.72.3,
scarthgap 2.78.4 -> 2.78.6, and wrynose 2.88.0 -> 2.88.2.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Fri, 31 Jul 2026 12:25:17 +0000 (14:25 +0200)]
systemd: inherit upstream-stable-release-point
systemd's README ("STABLE BRANCHES AND BACKPORTS") documents per-release
stable branches carrying backported patches. The current one, v261-stable,
is branched in the main repository; the README still points at the
systemd-stable repository, which holds the branches up to v255. The major
is a single version part (261 -> 261.1), so upgrades within a major
are stable point upgrades per the OE-Core stable release policy
(ref-manual, "Stable Point Release Upgrades"). STABLE_VERSION_PARTS is
set to 1 accordingly.
261.2 (Jul 23 2026), against 261.1 (Jun 26 2026): 277 commits, mostly
fixes. NEWS files both releases under "CHANGES WITH 261" and gives
neither its own entry. Four items are feature-shaped: refcounting,
argument handling and JSON output additions, plus one new internal
string-util flag.
Those are small internal additions on a real, diverged stable branch
rather than mainline drift, and none introduce a new subsystem: closer in
scope to a security-hardening batch than a feature release, though
broader than a pure bugfix release.
These bumps are not free: the scarthgap 255.4 -> 255.13 bump was held for a
v2 because TCLIBC=musl broke, and was merged once fixed. A point release
being fixes-only upstream does not remove the need to build and test it.
Already tracked this way on the OE stable branches, counting only bumps
made since each branch forked from master: kirkstone 250.4 -> 250.14 and
scarthgap 255.4 -> 255.21. wrynose has had no point-release bump yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Trevor Woerner [Sun, 2 Aug 2026 02:10:00 +0000 (22:10 -0400)]
image_types_wic: gate syslinux-native on the target, not the build host
A .wks needs the syslinux installer only when the target is x86.
image_types_wic.bbclass selects syslinux-native on the build host
architecture instead, so the dependency lands like this:
| x86 target | non-x86 target
-------------+------------+----------------
x86 host | yes | yes
non-x86 host | no | no
Two of those cells are wrong. An x86 image cross-built on a non-x86 host
gets the target bootloader without the installer that writes it, and an
x86 host building a non-x86 image builds an installer nothing uses.
Gate on the target, as wic-tools does [1]:
| x86 target | non-x86 target
-------------+------------+----------------
x86 host | yes | no
non-x86 host | yes | no
Bug 13276 [2] was an aarch64 host failing to build syslinux-native for
an ARM target, at a time when syslinux was x86-only in every variant. It
was closed in 2019 by gating on BUILD_ARCH [3]. Since 7273e131bfc7 [4]
only syslinux's target code is x86-specific, so a host gate is no longer
needed, and gating on the target keeps 13276's case fixed.
Trevor Woerner [Sun, 2 Aug 2026 02:09:57 +0000 (22:09 -0400)]
wic: add runtime dependencies on the tools it invokes
wic shells out to a range of host tools (parted, mkfs.*, mcopy, sfdisk,
and more) but, since the recipe was created, has declared none of them,
so an installed wic works only by chance depending on what the host
provides. Declare them as RDEPENDS so they are installed with wic.
The wic image type and wic-tools each carried a copy of that same list,
and the copies had drifted: only wic-tools staged tar-native and
util-linux-native. Neither needs a list of its own now. native.bbclass
makes a native recipe's do_populate_sysroot depend on its RDEPENDS, so
depending on wic-native stages the lot.
Three entries stay written out. cdrtools has only a native recipe, so
there is no package a target or nativesdk wic could name, even though
wic does run mkisofs. grub is bootloader territory and belongs to
whatever drives wic. pseudo is wic-tools staging what the oe-selftest
needs.
Trevor Woerner [Sun, 2 Aug 2026 02:09:56 +0000 (22:09 -0400)]
image_types_wic, wic-tools: drop the obsolete cross-binutils dependency
wic depends on virtual/cross-binutils because its EFI boot image plugin
once assembled unified kernel images and needed cross-objcopy for it.
That plugin no longer builds them: it refuses and points at
uki.bbclass, which declares virtual/cross-binutils itself.
No code wic runs invokes objcopy any more, so drop the dependency from
the two places still carrying it.
projects / thirdparty / openembedded / openembedded-core.git / log
