The --initial-rev option had no selftest coverage, which let the
regression fixed by the previous commit go unnoticed since 2023.
Extend test_devtool_update_recipe to run update-recipe twice more with
--initial-rev: once with the recorded initial revision, which must
produce the same result as not passing the option, and once with a
revision in the middle of the local commits, which must export only
the commits after it.
Without the fix in the previous commit, the first --initial-rev
invocation fails with "Unable to find initial revision - please
specify it with --initial-rev".
AI-Generated: Uses Claude (claude-fable-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Since 900129cbdf ("devtool: add support for git submodules") the
--initial-rev option of update-recipe and finish has been broken: the
parse loop in _get_patchset_revs() deliberately skips the recorded
"# initial_rev ." entry from the workspace bbappend when an override
is passed, but the override value itself is never inserted into the
initial_revs dict. For a recipe without submodules the dict therefore
ends up empty and update-recipe/finish fails in patch mode with:
ERROR: Unable to find initial revision - please specify it with
--initial-rev
i.e. passing --initial-rev produces the very error message that
instructs the user to pass --initial-rev. Before 900129cbdf the passed
value simply took precedence over the one recorded in the bbappend.
Seed initial_revs with the override before parsing so the option
behaves as documented again; recorded values are still used for
submodules and for the main repo when no override is given.
AI-Generated: Uses Claude (claude-fable-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
package.bbclass: hardcode emit_pkgdata to run last
Ensure emit_pkgdata runs after all PACKAGEFUNCS to allow layers to
extend packaging behavior.
Layers can now append custom functions via PACKAGEFUNCS += "func_name"
and they will run before emit_pkgdata generates package metadata.
oeqa/selftest/devtool: exercise devtool finish on an AUTOREV recipe
Adjust test_devtool_add_fetch_git() so that the recipe it creates with
SRCREV = "${AUTOREV}" is finished into a temporary layer instead of
just being reset: check that devtool finish succeeds (before the
previous commit srcrev mode failed with "fatal: bad revision
'AUTOINC'"), that the finished recipe still uses SRCREV = "${AUTOREV}",
and that no spurious patch files are generated. The reset it replaces
is covered by many other devtool tests.
srcrev mode is forced with --mode srcrev: update-mode guessing only
considers git:// URLs, so for this gitsm:// recipe auto mode would
select patch mode and never reach the code path being tested.
[YOCTO #16354]
Cc: Alexander Kanavin <alex.kanavin@gmail.com>
AI-Generated: Uses Claude (claude-sonnet-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
devtool: standard: fix finish/update-recipe for recipes using AUTOREV
For a recipe with SRCREV = "${AUTOREV}" (e.g. created by devtool add
--autorev), devtool finish and devtool update-recipe in srcrev mode
crash:
INFO: Updating SRCREV in recipe minit_git.bb
...
oe.patch.CmdError: Command Error: 'git format-patch --no-signature
--no-numbered AUTOINC -o /tmp/oepatchxu0ig0v0 -- .' exited with 128
Output: stderr: fatal: bad revision 'AUTOINC'
_update_recipe_srcrev() uses the recipe's SRCREV as the base revision
for exporting patches from the source tree, but for AUTOREV recipes
getVar('SRCREV') expands to the literal placeholder "AUTOINC", which is
not a valid git revision. Use the initial revision(s) recorded in the
workspace bbappend instead, as patch mode already does via
_get_patchset_revs().
Do not replace SRCREV with the current source tree HEAD for such
recipes either: pinning the revision on finish would silently drop the
floating revision the user explicitly asked for.
This is not a recent regression: the same crash reproduces at least as
far back as kirkstone, so it most likely dates back to the introduction
of devtool add --autorev.
[YOCTO #16354]
Reported-by: Gyorgy Sarvari <skandigraun@gmail.com>
AI-Generated: Uses Claude (claude-sonnet-5) Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The default python:pyasn1 does not match the NVD/CNA entries which use
pyasn1 as vendor, so CVEs like CVE-2026-30922 are never reported. Use
the exact pyasn1:pyasn1 pair.
Suggested-by: Ross Burton <ross.burton@arm.com> Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Jose Quaresma [Fri, 10 Jul 2026 15:57:21 +0000 (16:57 +0100)]
os-release: set BUILD_ID vardepsexclude with weak assignment
BUILD_ID is defined using a weak assignment so that we can modify it
externally. However, if we do it, we also need to do the same thing
for BUILD_ID[vardepsexclude] with the new value we assigned to
BUILD_ID.
Signed-off-by: Jose Quaresma <jose.quaresma@oss.qualcomm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
bindgen-cli: set CLANG_PATH in native and nativesdk wrappers to matching clang
bindgen uses the clang-sys crate to locate a 'clang' executable for
querying default include paths. clang-sys's search order is CLANG_PATH,
then libclang's directory, then 'llvm-config --bindir', then PATH.
When clang is used as the toolchain, the crossscripts llvm-config wrapper
honours YOCTO_ALTERNATE_EXE_PATH and reports the target sysroot bindir.
clang-sys's 'llvm-config --bindir' step then resolves to a target clang
that cannot execute on the build host, so bindgen fails with:
could not run executable .../recipe-sysroot/usr/bin/clang-NN:
No such file or directory (os error 2)
This is hit, for example, when building mesa with the rusticl/opencl
PACKAGECONFIG, whose do_compile runs the native bindgen against
rusticl_mesa_bindings.h, and when building rust-in-kernel via
kernel-yocto-rust.bbclass, which pulls in clang-native and
bindgen-cli-native.
Set CLANG_PATH to the clang that matches the wrapped libclang so
clang-sys uses the runnable binary first, short-circuiting the
llvm-config lookup. The wrapper already exports LIBCLANG_PATH the same
way.
The recipe is BBCLASSEXTEND = "native nativesdk", but only the native
variant had a wrapper. Add the equivalent nativesdk wrapper so an SDK
that runs bindgen (e.g. rust kernel-module development in the SDK) does
not hit the identical target-clang failure. The native wrapper uses
STAGING_*_NATIVE; the nativesdk wrapper uses the on-target ${libdir}/
${bindir} so create_wrapper's relocation rewrites the full path and the
shipped wrapper carries no build-time (TMPDIR) reference.
Ryan Eatmon [Mon, 6 Jul 2026 22:19:33 +0000 (17:19 -0500)]
oe-selftest: fitimage: Add tests for KERNEL_DTBVENDORED
The recent changes to fixing KERNEL_DTBVENDORED support and then adding
the same mapping for FIT_CONF_DEFAULT_DTB exposed that we were missing
tests for these two cases.
Signed-off-by: Ryan Eatmon <reatmon@ti.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ryan Eatmon [Mon, 6 Jul 2026 22:19:32 +0000 (17:19 -0500)]
kernel-fit-image: Add KERNEL_DTBVENDORED support for FIT_CONF_DEFAULT_DTB
When specifying a FIT_CONF_DEFAULT_DTB for a machine, you have to
exactly align the name with what will be in the fitImage file or you
will get a build error. If you also turn on KERNEL_DTBVENDORED then you
must also specify the vendor directory as part of the dtb name that you
want for the default, but you must manually do the same mapping that the
kernel-fit-image class is doing when it generates the fit-image.its file.
This patch just adds the same logic to figure out the value for the
requested default dtb and eliminate the need to understand the internal
mapping of the class. It should make specifying the value more
intuitive. The same value that you put in the KERNEL_DEVICETREE can be
used in the FIT_CONF_DEFAULT_DTB and the new code will correctly honor
the KERNEL_DTBVENDORED setting.
Ross Burton [Wed, 8 Jul 2026 17:36:51 +0000 (18:36 +0100)]
glibc: disable nscd by default
nscd is the Name Service Caching Daemon, which is useful when fetching
data from the configured Name Service Switch services is slow, for
example if NIS or LDAP is used.
This is unusual for typical OpenEmbedded deployments, and if caching is
needed there are a number of solutions (including nscd) that should be
considered.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 8 Jul 2026 17:36:50 +0000 (18:36 +0100)]
glibc: only inherit init script classes if nscd is enabled
As nscd is the only part of glibc that uses init scripts, we can use
inherit_defer to only pull systemd or update-rc.d into the build if nscd
has actually been enabled.
As systemd-systemctl-native has non-trivial dependencies (such as
python3-native), this can help reduce rebuilds of glibc.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 8 Jul 2026 17:36:49 +0000 (18:36 +0100)]
glibc: only install nscd if it's been enabled
Whilst the actual nscd binary won't be installed if the PACKAGECONFIG is
disabled, we were still installing the init scripts and configuration
files. These should be wrapped with PACKAGECONFIG checks.
${localstatedir}/db and makedbs.sh are part of libnss-db not nscd, so
ensure they're still always installed.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Convert to meson, remove autotools-specific tweaks and patches:
- conditionaltests.patch adds an option already available in meson
- 0001-Do-not-error-out-if-xsltproc-is-not-found.patch
(see below).
Add a patch and a meson option to avoid unneeded check for runtime python
module dependencies.
Move dependencies needed to run gtk-doc to gtk-doc bbclass
(so they aren't built and pulled in until actually needed).
This allows dropping the 'working-scripts' logic in the recipe,
except for xsltproc-native whose location is used during gtk-doc build.
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Analysis:
- CVE-2026-3497 affects downstream OpenSSH GSSAPI Key Exchange patches.
- The vulnerable code uses sshpkt_disconnect() in the GSSAPI KEX server path.
- Upstream OpenSSH/OE-Core does not carry the vulnerable GSSAPI key-exchange delta.
- Hence ignoring the CVE for this version.
Backport upstream fix for a global buffer overflow in the LZH
decompression logic (unlzh.c). The left[] and right[] global arrays
shared across LZW and LZH decompression routines are not reinitialized
between files processed in the same invocation, allowing an
out-of-bounds read in the LZH decoder.
Adapted for gzip 1.14:
- Refreshed NEWS and THANKS hunks to match 1.14 release context.
kernel-yocto: Set CLANG_FLAGS for kernel config checks when using clang
When building with `TOOLCHAIN = "clang"`, the kernel's configuration
check (do_kernel_configcheck) fails with:
kconfiglib.KconfigError: scripts/Kconfig.include:51: Sorry, this
assembler is not supported.
Fix by setting `CLANG_FLAGS = "-fintegrated-as"` in the environment
when `TOOLCHAIN` contains "clang". This variable is used by the kernel
build system (via scripts/Kconfig.include) to pass additional flags to
clang during config checks, ensuring the assembler test passes.
Acked-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Convert the existing GCC tool definitions to use the `:toolchain-gcc`
override so they only apply when `TOOLCHAIN = "gcc"` (the default).
Introduce new definitions for `:toolchain-clang` that use clang,
ld.lld, llvm-ar, llvm-objcopy, and llvm-strip, allowing the kernel
to be built with the LLVM/Clang toolchain.
Acked-by: Bruce Ashfield <bruce.ashfield@gmail.com> Signed-off-by: Harish Sadineni <Harish.Sadineni@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 8 Jul 2026 16:10:09 +0000 (17:10 +0100)]
lib/oe/utils: move INHIBIT_DEFAULT_DEPS from make_arch_independent() to allarch.bbclass
The bulk of the work in allarch recipes happens in handlers because the
finer details of how the recipe is configured varies. Specifically,
multilib recipes cannot be allarch and if multilib is enabled, the
packages are still tune-specific.
However, this means that recipes that are marked as allarch don't have
INHIBIT_DEFAULT_DEPS set in multilib environments, which is a problem
if it was being used to avoid dependency cycles.
Instead of assigning it at runtime if the recipe really does become
arch-independent, move the assignment from make_arch_independent() to
allarch.bbclass (the other caller in dummy-sdk-package.inc already sets
this). This means that recipes inheriting allarch always have
INHIBIT_DEFAULT_DEPS set.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
u-boot: re-enable RISC-V compressed (c) ISA extension
SRC_URI_RISCV clears every RISC-V ISA extension via
u-boot-riscv-isa_clear.cfg, then conditionally re-adds a fragment per
TUNE_FEATURES bit: a, f, d, b/zbb, zicbom. There is no line for c, even
though u-boot-riscv-isa_c.cfg (CONFIG_RISCV_ISA_C=y) already ships in
the recipe. So for any tune with c in TUNE_FEATURES (e.g. the default
rv64gc/rv32gc tunes), compressed instructions stay disabled after the
clear fragment runs, and .config ends up with:
# CONFIG_RISCV_ISA_C is not set
Building without RVC noticeably inflates .text: on qemuriscv64
(tune-riscv64, rv64gc), the resulting u-boot binary is 1312625 bytes of
.text without the fix vs 1082853 bytes with CONFIG_RISCV_ISA_C=y
correctly set, 229772 bytes (17.5%) smaller. On size-constrained
RISC-V SPL targets this .text growth can make the SPL .bss VMA overlap
the .text VMA and fail the link.
Add the missing "c" mapping line, mirroring the existing per-extension
entries (a, f, d, b/zbb, zicbom) already present in SRC_URI_RISCV.
Tested on oe-core master, MACHINE=qemuriscv64, via the
oe-nodistro-master bitbake-setup config:
bitbake -c cleansstate u-boot && bitbake u-boot
grep CONFIG_RISCV_ISA_C .../u-boot/2026.04/build/.config
# before: "# CONFIG_RISCV_ISA_C is not set"
# after: "CONFIG_RISCV_ISA_C=y"
do_package_qa passes both before and after; only the ISA config and
resulting .text size change.
Jörg Sommer [Tue, 7 Jul 2026 13:21:42 +0000 (15:21 +0200)]
systemd: Ship /srv with the package
If *volatile-binds* gets removed from RDEPENDS, the /srv directory is not
part of the image, and tmpfiles tries to create it on boot, but fails on a
read-only rootfs:
systemd-tmpfiles: /srv does not exist and cannot be created as the file system is read-only.
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Andreas Mützel [Tue, 7 Jul 2026 06:56:31 +0000 (08:56 +0200)]
cml1: use KCONFIG_CONFIG_ROOTDIR in savedefconfig
When running do_savedefconfig with a KCONFIG_CONFIG_ROOTDIR other than
B, this task runs oe_runmake in a directory different from the other
config-related tasks.
For example, in U-Boot with the new configuration flow from wrynose and
configs defined using the UBOOT_CONFIG_* variables, the project sources
and configs will be located in a subdirectory of ${B}. This will result
in the following error when running do_savedefconfig:
make: *** No rule to make target 'savedefconfig'. Stop.
Fix the do_savedefconfig task so it runs in KCONFIG_CONFIG_ROOTDIR.
Signed-off-by: Andreas Mützel <andreas.muetzel@emlix.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Mon, 6 Jul 2026 08:30:10 +0000 (10:30 +0200)]
flac: make documentation build deterministic
doxygen is autodetected (e.g. from HOSTTOOLS or a transient dependency).
Add a knob to make it deterministic when the documentation is being built.
Keep it disabled by default to preserve current default behavior.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Mon, 6 Jul 2026 08:30:09 +0000 (10:30 +0200)]
flac: fix buildpaths with doxygen enabled
When documentation is built, buildpaths errors occur.
There is one path to S and one to UNPACKDIR.
We can have a single sed rule to fix both.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
lzlib's configure script replaces CFLAGS from the environment with
its own defaults. As a result, the flags supplied by OpenEmbedded do
not make it into the generated Makefile.
Pass CFLAGS on the configure command line so the generated Makefile
uses the flags provided by the recipe.
Ross Burton [Fri, 10 Jul 2026 13:42:39 +0000 (14:42 +0100)]
python3-build: upgrade 1.5.0 -> 1.5.1
Highlights of the upstream changelog:
- feat(cli): accept sdist tarball as srcdir argument
- feat(deps): show wanted vs found in missing-deps error
- feat(cli): warn on valueless config settings
- feat(cli): add --sdist-extract-dir to reuse compiler caches
- feat(util): deprecate project_wheel_metadata
- feat: report resolved build dependency versions
- feat(env): control the isolated build environment location
- feat(cli): machine-readable build report, and metadata from a wheel
- fix(cli): drain verbose subprocess output without a worker thread
- fix(env): reject a file as --env-dir and drop a mutable default
- feat(cli): surface debug paths when a backend build fails
- fix(cli): fix CLI warnings being written to stdout instead of stderr
- fix: build correct dest path in Windows symlink support probe
- fix: derive dist-info directory from wheel contents, not filename
- fix: use LF instead of os.linesep when writing pip/uv requirements files
- fix: decide color support per output stream, not solely from stdout
- fix: minor robustness fixes from code review
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Fri, 10 Jul 2026 13:42:38 +0000 (14:42 +0100)]
fontconfig: upgrade 2.18.1 -> 2.18.2
Upstream release notes:
- Fix FcNameUnparse regression
- Use Special FC_CACHE_VERSION for snapshot
- Add more conditional code for FcLocaleSetCurrent()
- fc-cache: do not generate cache when target directory is in deny list
- Add Nerd Fonts to the table
- Add a hash table for fonts to generate expected genericfamily
- Use genericfamily for the search of monospace against :spacing=100
- test: Fix a test case failure when BUILDDIR is under /tmp
- test: Fix a regression for sysroot in test framework
- conf.d: Add OpenMoji Color and OpenMoji Black
- meson: Add tests-external-fonts option to disable network-dependent tests
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 10 Jul 2026 05:30:14 +0000 (05:30 +0000)]
cmake: upgrade 4.3.4 -> 4.4.0
License-update: libuv split a LICENSE file into a LICENSE-extra file but it
is all still MIT. https://github.com/libuv/libuv/commit/61e0bbda6bf2416210b54ad80bb3f19e4876a896
Also copyright year changes.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Briefly:
Alberta moved to permanent -06 on 2026-06-18.
Morocco moves to permanent +00 on 2026-09-20.
More integer overflow bugs have been fixed in zic.
Changes to future timestamps
Alberta’s 2026-03-08 spring forward was its last foreseeable clock
change, as it moved to permanent -06 thereafter. (Thanks to Roozbeh
Pournader and others.) Model this with its traditional abbreviation
CST. Although the change to permanent -06 legally took place on
2026-06-18, temporarily model the change to occur on 2026-11-01 at
02:00 instead, for the same reason we introduced a similarly
temporary hack for British Columbia in 2026b.
Although another TZDB release will likely be needed soon because
Northwest Territories will likely follow Alberta, the legal
formalities have not yet taken place.
Morocco plans to move back to permanent UTC, without daylight
saving time transitions, on 2026-09-20 at 02:00. This also
affects Western Sahara.
Changes to code
zic no longer overflows integers when processing outlandish input
like ‘Zone Ouch 0 - LMT 9223372036854775807’, ‘Zone Ouch 0 2562047788015215 LMT’, ‘Zone Ouch -2562047788015215:30:08 - LMT’,
and ‘Zone Ouch -2562047788015215:30:08 - %%z’. This avoids
undefined behavior in C. (Problems reported by Naveed Khan.)
On platforms that have EFTYPE, tzalloc now fails with errno set to
EFTYPE, not EINVAL, if it detects that the TZif file has an
invalid format or is not a regular file. Formerly it did this
only on NetBSD, and only when the file was not a regular file.
Unprivileged programs no longer require TZif files to be regular
files or reject relative names containing ".." components. This
reverts to the more-permissive 2025b behavior, as the stricter
behavior did not catch on in FreeBSD.
zic now reports any failure to remove a temporary file when
cleaning up after a previous failure. (Problem reported by Tom
Lane.)
Changes to commentary
Northwest Territories is expected to move to permanent -06 prior to
2026-11-01 02:00, when clocks would otherwise fall back. (Thanks to
Tim Parenti and James Bellaire.) Model this with its traditional
abbreviation CST. Unfortunately the change is not yet official, so
it is currently present only as comments that can be uncommented as
needed.
Changes to build procedure
The undocumented ‘typecheck’ Makefile check rule has been removed.
It stopped working in 2025a and evidently nobody noticed.
The rule was superseded by ‘check_time_t_alternatives’ in 2013d.
Peter Marko [Thu, 9 Jul 2026 20:35:36 +0000 (22:35 +0200)]
go: upgrade 1.26.4 -> 1.26.5
Upgrade to latest 1.26.x release [1]:
$ git --no-pager log --oneline go1.26.4..go1.26.5 c19862e5f8 (tag: go1.26.5) [release-branch.go1.26] go1.26.5 f9ef7f5598 [release-branch.go1.26] os: properly handle trailing slashes in paths in Root ca8ca590cc [release-branch.go1.26] crypto/tls: omit PSK in ECH outer client hello 7397dd7495 [release-branch.go1.26] net: fix TestLookupCNAME 044c995af7 [release-branch.go1.26] runtime: tolerate vendor suffixes in Linux kernel release strings 814591410b [release-branch.go1.26] cmd/compile,sync/atomic: make Add And & Or SQCST on PPC64 2055b1a15d [release-branch.go1.26] syscall: add //go:norace to rawSyscall on darwin d7c9c818f9 [release-branch.go1.26] runtime: in moveSliceNoCap, round size down to a whole multiple of element size dc80258a97 [release-branch.go1.26] internal/runtime/gc: require AVX512DQ for greentea 6efcff6602 [release-branch.go1.26] os/signal: make NotifyContext Cause match context.Canceled fe91cea4f2 [release-branch.go1.26] cmd/go: use fsys.ReadDir for IsStandardPackage ec988a9af1 [release-branch.go1.26] os: notify testlog from (*File).Chdir
libx11-compose-data: set CVE_PRODUCT to empty value
This recipe only builds and installs the compose data files (nls/) from
the libX11 sources and contains no compiled libX11 code, so libx11 CVEs
do not apply to it. When the x11 DISTRO_FEATURE is enabled this recipe
is skipped and libx11 itself is built and scanned instead.
t9042-dos-partition-limit.sh has failed 24 times over the past year on
qemuriscv64, which is using TCG emulation (slower) and thus can struggle
with higher system loads. Skip it for riscv64 builds by applying a patch
in that case.
Now, on qemuriscv64:
|PASS: t9041-undetected-in-use-16th-partition.sh
|t9042-dos-partition-limit.sh: skipped test: this test frequently reports a timeout under heavy system load
|SKIP: t9042-dos-partition-limit.sh
|PASS: t9050-partition-table-types.sh
|PASS: t9060-gpt-grow-script-fix.sh
|============================================================================
|Testsuite summary for GNU parted 3.7
|============================================================================
|# TOTAL: 100
|# PASS: 85
|# SKIP: 15
|# XFAIL: 0
|# FAIL: 0
|# XPASS: 0
|# ERROR: 0
|============================================================================
|make: Leaving directory '/usr/lib/parted/ptest/tests'
|DURATION: 255
|END: /usr/lib/parted/ptest
|2026-07-08T14:27
|STOP: ptest-runner
|TOTAL: 1 FAIL: 0
|root@qemuriscv64:~#
Changqing Li [Fri, 15 May 2026 08:37:50 +0000 (16:37 +0800)]
report-error.bbclass: add site.conf/toolcfg.conf into error report
We had add local.conf/auto.conf into error report to help more easy to
reproduce a failure through error report, recently oe add a new default
configuration file toolcfg.conf, this commit also add site.conf and
toolcfg.conf in error report.
With this commit, the error report file will have the below snip:
[snip]
"site_conf": "DL_DIR ?= \"/bitbake-setup/bitbake-builds/.bitbake-setup-downloads\"\nSSTATE_DIR ?= \"/bitbake-setup/bitbake-builds/.sstate-cache\"\nBB_HASHSERVE_DB_DIR ?= \"${SSTATE_DIR}\"\n",
"target_sys": "x86_64-poky-linux",
"toolcfg_conf": "OE_FRAGMENTS += \"distro/poky machine/qemux86-64\"\n"
[snip]
[YOCTO #13252]
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The tpm PACKAGECONFIG passed "-D TPM_ENABLE=TRUE/FALSE", but ovmf
renamed that macro to TPM2_ENABLE in edk2 commit 4de8d61bcec0
("OvmfPkg: rework TPM configuration", first released in
edk2-stable202202). Since then TPM_ENABLE has been an unknown macro
that edk2 ignores, so TPM2 support was never compiled in, even for
MACHINEs with 'tpm'/'tpm2' in MACHINE_FEATURES.
Use TPM2_ENABLE (as defined in
OvmfPkg/Include/Dsc/OvmfTpmDefines.dsc.inc and consumed by
OvmfPkgX64.dsc) so the tpm PACKAGECONFIG actually enables TPM2 support.
The same commit also added a separate TPM1_ENABLE macro (TPM 1.2
support, default TRUE), but its dsc.inc snippets are only included
inside OvmfPkgX64.dsc's "!if $(TPM2_ENABLE) == TRUE" block, so it has
no effect unless TPM2_ENABLE is TRUE. No separate PACKAGECONFIG knob is
needed.
I'm sending a backport to wrynose of this in another email.
Signed-off-by: Eilís 'pidge' Ní Fhlannagáin <pidge@baylibre.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The bootchart.org domain is no longer available. Replace with
the current project page at bootchart.sourceforge.net.
The upstream GitHub repo (code.google.com/p/pybootchartgui) uses Python 2
with tabs indentation while oe-core uses Python 3 with spaces. The two
codebases have diverged.
oeqa/selftest/kernelmodulesplit: test cross-recipe kernel module dependencies
Add a selftest that exercises kernel module dependency generation across
recipes. Two external module recipes are added to meta-selftest:
kernel-module-testfoo exports a symbol and kernel-module-testbar consumes
it (DEPENDS on testfoo). The test builds both and asserts that the
consumer's real, KERNEL_VERSION-suffixed package RDEPENDS the exporter's
suffixed package - and not the empty unsuffixed kernel-module-testfoo
package - and that the suffixed package RPROVIDES the unsuffixed virtual.
This is the failure mode originally reported in [YOCTO #12290], where the
generated dependency resolved to the empty package after the KERNEL_VERSION
suffix was introduced. It works on current master; this test guards against
regressing it again.
The kernel version is derived from the produced package list rather than
KERNEL_VERSION, which is unset at parse time when the modules are restored
from sstate.
buildtools-extended-tarball: drop wic helper tools
The extended buildtools tarball exists to make a host with inadequate
or ancient software able to run bitbake builds: it provides a compiler,
autotools, python3, git, tar and the rest of the build essentials. The
things it ships are the build prerequisites a build host is otherwise
expected to provide.
nativesdk-parted, -dosfstools and -gptfdisk do not fit that purpose.
They are not build prerequisites; they are disk-image helper tools that
only make sense for someone assembling or inspecting a .wic image, and
they do not belong in the set of essentials this tarball guarantees.
Drop the three entries so the tarball's contents stay limited to what
its description promises.
When using the "tarfile" module with a file opened in "streaming mode"
(mode="r|") the tarfile module did not properly handle EOF, making archive
parsing take exponentially longer.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
tarfile.extractall() with the 'data' or 'tar' filter could be bypassed
by a crafted archive where a hardlink references a symlink stored at a
deeper name than the hardlink itself.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A flaw was found in GLib. A state confusion issue exists in
g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when
processing malformed D-Bus introspection XML, specifically with a <node>
element nested within other elements like <method>, <signal>, <property>
or <arg>. This issue can cause an unsigned integer overflow and lead to an
out-of-bounds read, resulting in a denial of service.
The CVE NVD entry is wrong, it indicates that the CVE is fixed in 2.88.1
but the fix was realized in 2.89.0, see [1]. The fix is not present in 2.88.2.
Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 8 Jul 2026 11:11:05 +0000 (12:11 +0100)]
mesa-demos: switch to fetching from git instead of tarballs
Upstream don't plan on making new releases of mesa-demos as it's mostly
demos and test applications. As a first step to moving to git, this
changes the fetching of a tarball to the fetching of the git tag that
the tarball was generated from.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
files/common-licenses/MIT-with-fmt-exception: add a custom license
This is needed to correctly specify fmt's LICENSE, as support
for license exceptions and WITH statement isn't yet implemented:
https://lists.openembedded.org/g/openembedded-core/message/239820
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Moritz Haase [Mon, 6 Jul 2026 10:45:39 +0000 (12:45 +0200)]
json-c: upgrade 0.18 -> 0.19
Release notes are available at [0].
Newly added tests (see [1]) require the 'json_parse' app at (test) runtime.
Thus, apps are now being built and the 'json_parse' app is deployed in the
'ptest' package. We do not package the apps separately as upstream doesn't
consider them to be ready for that (see [2]). This approach is based on the
discussion in [3].
Ross Burton [Mon, 6 Jul 2026 10:21:38 +0000 (11:21 +0100)]
busybox: enable xxd
The xxd binary is very small and a non-zero number of test suites use
xxd to generate test data.
Enable xxd in busybox to avoid having to pull vim's xxd into builds. It
does not have feature parity with vim's xxd, but it's close enough for
many tests and vim's xxd still exists for the others.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Build only gn, as otherwise ninja will attempt to run the integration
tests (which are cross-compiled). Only gn executable is installed,
so this doesn't reduce the output in ${D}.
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop -DSHARED_ONLY=True (replaced upstream with LIBICAL_STATIC, false by default).
Drop 0001-cmake-Do-not-export-CC-into-gir-compiler.patch (merged upstream).
Rebase flags.patch (couldn't find evidence of ical-glib-static and so
that chunk was dropped).
Rework various upstream cmake options.
License-Update: file renamed, additional information added at the bottom:
https://github.com/libical/libical/blob/v4.0.3/LICENSE.txt
LGPL/MPL texts aren't necessary to track, as LICENSE.txt specifies
what the actual terms are.
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Updated SRC_URI, Homepage, BugTracker, UPSTREAM_CHECK_URI to point to
github page of log4cplus instead of sourceforge as per:
[1] https://github.com/log4cplus/log4cplus/wiki#download
For detailed information, see the link below:
[1] https://github.com/log4cplus/log4cplus/compare/REL_2_1_2...REL_2_2_0_1
[2] https://github.com/log4cplus/log4cplus/blob/REL_2_2_0_1/ChangeLog
The release notes claim a fix for .pc file in vulkan loader:
https://vulkan.lunarg.com/doc/sdk/1.4.350.1/linux/release_notes.html
but the .1 tag points to the same commit as .0 tag:
https://github.com/KhronosGroup/Vulkan-Loader/tags
(and the same commit is tagged as .1 in all other components).
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
License-Update: drop BSL-1.0 as sub-component that used it is no longer in source tree.
Disable building items written in rust (until now, git would quetly fall
back to C by default, as of this version it no longer does). At some point rust
code will have to be enabled; for now it's optional.
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 8 Jul 2026 11:11:04 +0000 (12:11 +0100)]
xmlto: update SRC_URI
xmlto was previously hosted on Fedora's pagure.io server, but this is
being decomissioned. As xmlto isn't Fedora-specific the repository has
migrated to codeberg.org.
>From discussion with Michal Schorm <mschorm@redhat.com>:
I became the new maintainer of the project upstream and after a
discussion with Kevin Fenzi, migrated it to a new home on the
codeberg.org: https://codeberg.org/xmlto/xmlto
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
kernel.bbclass: fix typo in comment, "INTIRAMFS_TASK"
Correct "INTIRAMFS_TASK" to "INITRAMFS_TASK" in comment.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
projects / thirdparty / openembedded / openembedded-core-contrib.git / log
