Adapted from an existing patch:
https://patchwork.yoctoproject.org/project/oe-core/patch/20220606132653.60232-5-brgl@bgdev.pl
Update the recipe to track the latest upstream release of the official
GStreamer Rust plugins.
Remove the `flavors` and `ffv1` plugins from local manifest file because
they depend on packages that are not published on crates.io and also they
are not actively maintained in the gst-plugins-rs upstream anyway.
Skip the recipe if building for x86 without SSE support.
Unlike the other GStreamer submodules, the Rust plugins follow a
separate release cycle and versioning scheme. These plugins are fully
stable and required for a fully-featured GStreamer installation, as most
new features and plugins are being written in Rust. They are also shipped
by multiple Linux distributions such as Fedora.
Based on patch by: Bartosz Golaszewski <brgl@bgdev.pl>
ncurses: put symlinks to basic terminfo files in ncurses-terminfo-base package
With only the ncurses-terminfo-base package installed (i.e. not the
full ncurses-terminfo), systemd prints
Terminfo xterm-256color not found for /dev/console
That is despite 'xterm-256color' being one of those basic terminfo
files that are manually split off and into the terminfo-base package,
and placed under /etc/terminfo/. The reason is that systemd only looks
in /usr/share/terminfo (see their have_terminfo_file() in
src/basic/terminal-util.c).
Make sure that applications that only look in /usr/share/terminfo do
find the basic terminfo files by packaging the symlinks along with the
pointed-to files.
Richard Purdie [Mon, 27 Jul 2026 10:55:47 +0000 (11:55 +0100)]
sstate: Update unpack touch code to be consistent
When we unpack sstate files, we want to update the mtime+atime of the sstate
object and any sig/siginfo files, both for the files themselves and symlinks.
The logic was getting a bit hard to follow and wasn't entirely consistent with
only a time in some cases.
Clean it up and be consistent for all the files.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Mon, 27 Jul 2026 10:49:29 +0000 (11:49 +0100)]
sstate: Update mtime/atime for sig/siginfo files in sstate_checkhashes()
If we touch sstatefile, we should also touch any .sig/.siginfo file if we can.
We try and keep them both updated with accesses so one isn't removed without
the other and they stay consistent.
[YOCTO #15289]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Esa Jaaskela [Sun, 26 Jul 2026 19:24:41 +0000 (22:24 +0300)]
volatile-binds: order systemd-timesyncd after /var/lib
systemd-timesyncd stores its clock file under /var/lib/systemd/timesync,
so it can fail to save state if it starts before the volatile /var/lib
is mounted. Add it to the Before= and WantedBy= entries already used for
systemd-random-seed.service.
Signed-off-by: Esa Jaaskela <esa.jaaskela@suomi24.fi> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 23 Jul 2026 13:55:14 +0000 (14:55 +0100)]
wget: enable libpsl in target builds
The Public Suffix List[1] is a list of domains that people can register
domains under, for example ".com" or ".co.uk". This is useful because
it means browsers and other HTTP using tools can prevent malicious
web sites from setting privacy-damaging "supercookies".
In the interest of being more secure out of the box, enable libpsl in
builds of wget (note that we never build wget-native, as it is provided
by the host).
[1] https://publicsuffix.org
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 23 Jul 2026 13:55:13 +0000 (14:55 +0100)]
curl: enable libpsl in target builds
The Public Suffix List[1] is a list of domains that people can register
domains under, for example ".com" or ".co.uk". This is useful because
it means browsers and other HTTP using tools can prevent malicious
web sites from setting privacy-damaging "supercookies".
In the interest of being more secure out of the box, enable libpsl in
target builds of curl.
[1] https://publicsuffix.org
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libpsl: Fix meson configure failure when docs are enabled
libpsl 0.23.0 ships docs/libpsl/meson.build referencing an undefined
"cdata" configuration object; the top-level meson.build only defines
"_cdata". meson shares scope across subdir(), so with docs enabled (which
OE does via gtk-doc) do_configure fails:
libpsl: Do not embed the build path in suffixes_dafsa.h
The generated src/suffixes_dafsa.h records the public suffix list it was
built from in _psl_filename[]. meson feeds psl-make-dafsa an absolute
input path, so the full build directory gets baked into the header and,
through it, into the library and its -src/-dbg packages. On an
autobuilder whose build tree lives under $HOME/TMPDIR this trips the
buildpaths QA check with references to both TMPDIR and the build host
HOME directory, and it makes the build non-reproducible.
The absolute path is useless on the target: it is only consumed by
psl_builtin_outdated() to stat() the source list, which never exists on
the running system. psl_builtin_filename() is documented to return "the
file name", so embed only the basename.
Fixes
ERROR: libpsl-0.23.0-r0 do_package_qa: QA Issue: File /usr/src/debug/libpsl/0.23.0/src/suffixes_dafsa.h in package libpsl-src contains reference to TMPDIR [buildpaths]
ERROR: libpsl-0.23.0-r0 do_package_qa: QA Issue: File /usr/src/debug/libpsl/0.23.0/src/suffixes_dafsa.h in package libpsl-src contains a reference to the build host HOME directory. If upstream hardcodes a directory path that matches your home, you can set OEQA_BUILDPATHS_SKIP = "/srv/pokybuild" in the recipe. [buildpaths]
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- inherit meson instead of autotools; drop gettext (the meson build has
no i18n)
- Map the PACKAGECONFIG knobs to meson options: --enable-runtime=X
becomes -Druntime=X, and builtin PSL data stays enabled via meson's
default (-Dbuiltin=true), matching the previous --enable-builtin.
- Disable the bundled tests and fuzzers with -Dtests=false.
- The gtk-doc class drives -Ddocs on its own via GTKDOC_MESON_OPTION.
Unlike the autotools tarball, meson regenerates psl.1 at build time and
stamps it with `date +%B %Y`, which is not reproducible. Backport the
proposed upstream fix to honour SOURCE_DATE_EPOCH.
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The CERT-PL record for CVE-2026-42250 carries bzip2:bzip2 in its
affected entry [1], which the bzip:bzip2 pin does not cover, so tools
consuming CNA identities cannot connect the in-tree
CVE-2026-42250.patch to the CVE. NVD has not analysed the entry yet
and currently mirrors the same bzip2:bzip2 identity.
Peter Marko [Tue, 21 Jul 2026 19:00:04 +0000 (21:00 +0200)]
libinput: set status for CVE-2026-35094
This CVE is fixed in 1.31.1 per [1]
It is present in CVE reports as open because it's RedHat version-less.
This was originally patched and CVE patch was removed during upgrade
1.30.2 -> 1.31.3 because the patch was integrated in that release.
Peter Marko [Tue, 21 Jul 2026 19:00:03 +0000 (21:00 +0200)]
connman: remove connection_manager from CVE_PRODUCTS
The only CVE with this product/cpr is CVE-2013-10036 which is for
different connection manager and is showing up as false positive in CVE
reports with current sbom-cve-check tooling.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ivan Nestlerode [Tue, 21 Jul 2026 20:37:06 +0000 (16:37 -0400)]
mpg123: fix lack of NEON usage on aarch64
Fixes [YOCTO #16359]
mpg123 supports specific --with-cpu= configure options to use NEON
instructions, but this recipe was not using any of these on aarch64.
The problem is that it was only keying off of whether TUNE_FEATURES
contains "neon". aarch64 never puts "neon" into TUNE_FEATURES so it
has to be checked separately.
Use --with-cpu=neon64 on aarch64.
Signed-off-by: Ivan Nestlerode <ivan.nestlerode@sonos.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Thu, 23 Jul 2026 19:37:44 +0000 (20:37 +0100)]
libgit2: remove library paths from installed .cmake
The libgit2 cmake rules generate a .cmake file that tells people linking
to libgit2 how to link. This includes the complete path to each of the
libraries that libgit2 links, such as /path/to/sysroot/usr/lib/libssl.so.
The build paths were previously removed with a quick sed, but this breaks
builds where those target paths exist on the build host as they get used
verbatim.
However, all of this linkage is redundant as the library directly links
to these libraries. Mark the linkage as private, so the references do
not appear in the .cmake files.
[ YOCTO #16373 ]
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Martin Jansa [Thu, 23 Jul 2026 09:25:43 +0000 (11:25 +0200)]
glib-networking: clarify the LICENSE
As suggested by Joshua:
https://lists.openembedded.org/g/openembedded-core/message/241541
https://github.com/GNOME/glib-networking/blob/2.80.1/LICENSE_EXCEPTION
The text of the exception is very close to the
https://spdx.org/licenses/openvpn-openssl-exception.html (with replacements)
Signed-off-by: Martin Jansa <martin.jansa@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Thu, 23 Jul 2026 15:53:16 +0000 (08:53 -0700)]
python3-certifi: upgrade 2026.6.17 -> 2026.7.22
f4bc676 2026.07.22 (#428) 4c91f9c Bump actions/setup-python from 6.3.0 to 7.0.0 (#427) 01a66c5 Bump actions/checkout from 7.0.0 to 7.0.1 (#426) eb355f4 Bump pypa/gh-action-pypi-publish from 1.14.0 to 1.14.1 (#425) 474e6fc Include tests in the source distribution (#424) a31ef39 Bump actions/setup-python from 6.2.0 to 6.3.0 (#420) 98eb2c7 Bump actions/checkout from 6.0.3 to 7.0.0 (#419)
For full comparison of changes, see:
https://github.com/certifi/python-certifi/compare/2026.06.17...2026.07.22
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 22 Jul 2026 10:12:06 +0000 (11:12 +0100)]
pkgconf: upgrade 3.0.3 -> 3.0.4
Changes from 3.0.3 to 3.0.4:
----------------------------
* Fix a crash (stack overflow) triggered by a crafted .pc file containing a
self-referential fragment variable, such as `x=$${x}` referenced from Cflags.
Fragment variables are now evaluated only once while re-splitting. Found
through fuzzing.
* Fix over-escaping of variable values containing backslash-escaped whitespace,
such as paths quoted with `printf %q`. Such a value was stored with its
escapes intact and then escaped a second time when rendered into a fragment,
producing output like `-L/a\\\ dir`. This broke meson's test suite, which
uses paths with spaces to stay Windows-safe.
* Fix mangled and duplicated -L/-I paths on Windows when PKG_CONFIG_SYSROOT_DIR
and PKG_CONFIG_LIBDIR are set. Path separators are now normalized to forward
slashes for all runtime-injected paths (sysroot, build root, search paths and
pcfiledir), so that sysroot matching and injection operate on a consistent
basis.
* Fix `--define-prefix` dropping a path separator when the redefined prefix ends
with a trailing slash, and only rewrite a package's directories when they match
the original prefix on a path component boundary.
* Fix single-package queries returning results drawn from more than the requested
module, by restoring the package limit that was lost during a refactor of the
query builder.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The BIND 9.20.25 release was withdrawn after the discovery of a
regression in a security fix in it during pre-release testing.
BIND 9.20.26
------------
Security Fixes
~~~~~~~~~~~~~~
- [CVE-2026-11331] Fix handling of rpz CNAME expansion that returns name
too long. ``b950da5f625``
Previously, if the expansion of a wildcard CNAME RPZ policy resulted
in a name that exceeded the length limit, a self referential CNAME and
the original address record were returned, allowing the policy to be
bypassed. In branches up to 9.20, this also left query processing in
an inconsistent state which could trigger an assertion failure. We
now return a YXDOMAIN response, without the address.
ISC would like to thank Laith Mash'al (0xmshal) for bringing this
issue to our attention. :gl:`#5856`
- [CVE-2026-11721] Invalid signed wildcard records were being accepted.
``249752cd72d``
Signed wildcard responses in which the Labels field in the `RRSIG`
record was less than the number of labels in the Signer Name field
were being incorrectly accepted. This in turn broke
`synth-from-dnssec`, which depends on such records being correctly
validated. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue
to our attention. :gl:`#5871`
- [CVE-2026-13321] Fix DNSSEC validation bypass via out-of-zone NSEC
Next Field. ``6fbc963d4af``
A malicious zone with out-of-zone NSEC next owner names can cause a
DNSSEC validating resolver to cache such record and, if
`synth-from-dnssec` is enabled, to generate negative answers for any
zone that is covered by the range.
ISC would like to thank Qifan Zhang of Palo Alto Networks for
reporting the issue. :gl:`#5873`
- [CVE-2026-10723] Correct verification of NSEC3 signer name.
``df3abfc3184``
BIND 9 accepted child-zone NSEC3 records where the first label equals
the hash of the parent zone as valid parent-zone closest encloser
proofs. This has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue.
:gl:`#5874`
- [CVE-2026-12617] Do no assert for some specifics CNAME and DNAME
queries. ``d75d1e93958``
A bug in the resolver's handling of certain cached DNAME and CNAME
responses could cause named to trigger an assertion failure and exit.
An attacker controlling a domain name and the authoritative DNS server
it is hosted on could exploit this behavior to cause a
denial-of-service. This vulnerability has been fixed.
ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue
to our attention. :gl:`#5946`
- [CVE-2026-10822] Malformed DNSKEY records could trigger an assertion.
``a1777ce7ee0``
Previously, `dns_name_fromwire()` did not honor the record boundary
when reading names from the wire, allowing malformed records to be
accepted when they should not have been
[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
git log --oneline v2.6.0..v2.6.1: 2f0f3b0e9121 tests: remove the fuzzer from test 62-sim-arch_transactions 7c3f80d95bcc doc: mention EINVAL in seccomp_transaction_start(3) 84005ecc603f hash: fix strict aliasing UB in MurMur hash implementation dd759e8c4f56 api: fix seccomp_export_bpf_mem out-of-bounds read 8e31cd254be3 github: bump codeql version to v3 38c524f982d4 gh: bump ubuntu 24.04 311cb32bcc4a tests: Skip tests 60 and 61 on x32 2d0ed0cbcc3b db: propagate notify_used when merging filter collections 7bf87a67bc87 db: Fix tab/space issue with previous commit 1e6797415029 doc: Add seccomp_transaction_start.3 to Makefile.am c144002c9361 python: fix in-source python builds 4c21f22c31d1 doc: fix a missing CHANGELOG entry from v2.6.0 24033394ad69 tests: Fix shebang for python3 6abe14d1645e python: Fix shebang in setup.py bcb9d0b35fa1 syscalls: fix s390 at Linux v6.18 792976a12e38 arch: Ignore comment lines in arch-syscall-validate fea23415b090 syscalls: update syscall table to Linux v7.1.0-rc4 700b140cdd63 db: fix a copy-n-paste typo in _db_tree_add() 2d9db17cc0da bpf: properly reset/clear the bpf_program on error in _bpf_append_blk() 8d1f8a977177 helper: only clear memory on zrealloc() if the buffer grows dc9fcd66d0c2 bpf: protect against addition overflows when building the filter 4121c0e04116 docs: update the CREDITS file a81cc2de8ee7 doc: CHANGELOG entry for libseccomp v2.6.1
Note: GitHub-style username tag removed from upstream log entry to
avoid unintended notifications on mirrored repos.
Richard Purdie [Wed, 22 Jul 2026 05:42:11 +0000 (05:42 +0000)]
python3-setuptools-scm: upgrade 10.2.0 -> 10.2.1
- Omit ``scm_version.json`` and ``scm_file_list.json`` from wheel ``.dist-info``
while still including them in sdists for fallback discovery. ([#1473](https://github.com/pypa/setuptools-scm/issues/1473))
- Pass `project_root` from egg_info to the workdir so file discovery is correctly scoped in monorepo setups. ([#1440](https://github.com/pypa/setuptools-scm/issues/1440))
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
speedo: Create a pkgversioninfo.txt file.
+ commit 8716b4dac4a79b600d18847b8bc0193bd06e1fc1
* build-aux/mk-sbom.sh: New. Taken from gpg4win and extended.
* Makefile.am (EXTRA_DIST): Add it.
* build-aux/speedo.mk (gnupg_ver_this): Use sed to extract version.
(gnupg_commit_id): new.
(00-unpack): Call mk-sbom.sh.
(clean-pkg-versions: Clear version files.
($(bdir)/pkgversioninfo.txt): New.
(all-speedo,installer): Depend on above.
(dist-source): Exclude autom4te.cache just in case
* build-aux/speedo/w32/inst.nsi: Install pkgversioninfo.txt.
speedo: Fix passing configure args to w32 builds.
+ commit 7af73849a5dbbc5c70e43c3a3f5d70c639c80ab4
* build-aux/speedo.mk (pkgcfg): Use correct number of dollar signs.
common: Prepare to get rid of map_w32_to_errno.
+ commit bf808091534f587e8cdacf351b0e7ba060165fd8
* common/sysutils.c (gnupg_w32_set_errno): Use gpgrt function if
available.
agent: Make batch import of Kyber keys work.
+ commit 4fca79b67bba04bc5ef2a4402e948c01821ceac5
* agent/command.c (cmd_import_key): Allow --unattended also for
composite keys.
2026-06-26 NIIBE Yutaka <gniibe@fsij.org>
dirmngr: Add a validation check in get_dns_cert_standard.
+ commit c3ec7678799a161b9265969e7ad3fd59605b18ab
* dirmngr/dns-stuff.c (get_dns_cert_standard): Validate the length.
gpgsm: Require a minimum tag length for GCM decryption.
+ commit 4c7e68cf3d335328821bdbb70db309a60d0e4fd4
* sm/decrypt.c (gpgsm_decrypt): Require a minimum authtaglen.
2026-06-18 NIIBE Yutaka <gniibe@fsij.org>
w32:common: Fix usleep in w32_wait_when_sharing_violation.
+ commit ab9ce5f5e775a3a6a37923299685ac371f740103
* common/sysutils.c (w32_wait_when_sharing_violation): WTIME is
in milliseconds.
2026-06-17 Philip Le <philip.le@gnupg.com>
gpg: Fix copy_signature.
+ commit 56e11ffe971d5cc58185b4e8d02b82dc432c634b
* g10/free-packet.c (copy_signature): Set the signers_uid of the new
copy to NULL if it is not present in the source signature.
gpg: Use the INT_RCP_FPR subpacket in revocation signatures.
+ commit 9e0e5547d2a008332873a9b632f82f9414ad887f
* common/openpgpdefs.h (sigsubpkttype_t): Add Intended Recipient
Fingerprint signature subpacket.
* g10/build-packet.c (build_sig_subpkt): Build the Intended Recipient
Fingerprint signature subpacket for v4 and v5 keys.
* g10/free-packet.c (fre
[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Fri, 24 Jul 2026 05:16:38 +0000 (05:16 +0000)]
dropbear: upgrade 2026.92 -> 2026.94
2026.94 - 23 July 2026
- Fix scp build failure regression from 2026.93
The new ascii_isdigit() etc wasn't linked.
- Print square brackets around ipv6 addresses with ports, eg
[2a00:f10:400:2:1c00:bcff:fe00:1c6]:22
Patch from Seo Suchan
- Support longer paths in scp.
- Avoid some build warnings, add increase github action coverage of
config options.
2026.93 - 21 July 2026
Note >> for compatibility/configuration changes
- Security: Fix a use-after-free in X11 forwarding that could possibly lead
to memory corruption. This is vulnerable to authenticated users if X11
forwarding is enabled. By default X11 forwarding is not built.
In 2026.89 the server is running as the authenticated user for X11
forwarding, in earlier versions it runs as root.
This removes X11 "single connection" which has probably never been used.
Reported by @peter-pe
https://github.com/mkj/dropbear/commit/882f83806d5e133037cd28e954a878984ef7b9c4
- >> "permitlisten" authorized_keys lines will now be ignored if
the port is invalid (>65535). From Basavaraj S Maneppagol.
- >> In 2026.92, the configure option --enable-plugin-deprecated
wasn't correctly renamed. This is now implemented.
Patch from Alexander Dahl
- Two factor auth "-t" is no longer deprecated, it will be kept.
The "DEPRECATED_TWO_FACTOR" option is ignored, and no longer required.
- Fix out of bounds read during utmp/wtmp log file handling, reported by
Basavaraj S Maneppagol.
- More robust handling of ascii inputs for some platforms.
From Basavaraj S Maneppagol
- Convert manpages to mdoc format, from shrub
[Updated 16 July: This is no longer planned to be removed, future releases
will ignore DEPRECATED_TWO_FACTOR and always enable it, like previously]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Sat, 25 Jul 2026 05:36:53 +0000 (05:36 +0000)]
python3-cython: upgrade 3.2.8 -> 3.2.9
3.2.9 (2026-07-23)
==================
Bugs fixed
----------
* Indexing into freshly created lists with an out-of-bounds index could crash.
(Github issue :issue:`7793`)
* Function arguments with default values could end up uninitialised in closures, leading to crashes.
Patch by Anthony Donlon. (Github issue :issue:`7782`)
* ``bytearray.append(None)`` could crash. The optimised code was also lacking concurrency guards.
(Github issue :issue:`7796`)
* Some rare corner cases when concatenating text strings were resolved.
(Github issue :issue:`7799`)
* Assignments of builtin string types to typedefs of `object` could erroneously be rejected.
(Github issue :issue:`7789`)
* Subscripting ``type`` failed with a ``TypeError``.
(Github issue :issue:`5563`)
* Manually disabling ``CYTHON_VECTORCALL`` in CPython could lead to invalid C code.
Patch by Florent Gallaire. (Github issue :issue:`7807`)
* Some internal Limited API version checks for Py3.12 were corrected.
(Github issue :issue:`7845`)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Improves the debugging output when parsing an SPDX file fails by
reporting the file name (since this is not normally visible from the
backtrace). Continue to raise the exception after reporting the file
name to get the full backtrace.
Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The diff is quite large, but a partial comparison can be seen:
https://github.com/fkie-cad/nvd-json-data-feeds/compare/v2026.06.24-000003..v2026.07.23-000007
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The diff is quite large, but a partial comparison can be seen:
https://github.com/CVEProject/cvelistV5/compare/2026-06-24_baseline..2026-07-23_baseline
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Thu, 23 Jul 2026 20:48:31 +0000 (13:48 -0700)]
fragments/yocto/sbom-cve-check: fix conflict with tag=
Fixes: 00864cf5bc meta: Add tag in SRC_URI to multiple recipes
When this fragment is enabled, SRCREV is set to AUTOREV, but this then
causes do_unpack to fail for both sbom-cve-check-update-cvelist-native
and sbom-cve-check-update-nvd-native, since the tag SRCREV does not
match with the 'main' HEAD AUTOREV.
Rather than allow the tag to float, for those that desire reproducible
builds with just IMAGES_CLASSES:append = " sbom-cve-check" and not
this fragment, set SRC_URI **without** the tag= in this fragment.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Thu, 23 Jul 2026 12:51:13 +0000 (13:51 +0100)]
resulttool: Add support for ptests results for both musl and glibc
The code currently assumed a DISTRO has one libc and can't handle the case
where there are ptest results for both. Add in TCLIBC to the result data
to allow them to be differentiated and add support in the reporting to
see the difference between them.
We need to carefully handle the case where there is no TCLIBC data in the
results as the code currently assumes all data is present.
[YOCTO #16357]
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 20 Jul 2026 19:45:10 +0000 (20:45 +0100)]
classes/cargo: remove BUILD_MODE, replace with CARGO_PROFILE
The BUILD_MODE variable appears to be a way to select the Cargo build profile
that is used, but it can't be assigned because it and other pieces of
code base their logic on the value of DEBUG_BUILD.
Instead of a BUILD_MODE variable that is "--release" or "" depending on
the value of DEBUG_BUILD, replace it with a clear CARGO_PROFILE variable
that selects the profile to use. The default has the same behaviour as before:
either "release" or "dev" based on DEBUG_BUILD.
This profile is then passed to cargo, and used to construct paths in the
build tree (with the caveat that the "dev" profile puts files in "debug").
kernel.bbclass: pass args instead of tuple of args to runstrip()
Since commit 7c99f90079e7 ("lib/package/utils: Improve
multiprocess_launch argument passing"), runstrip() now expects arguments
individually instead as a big tuple so let's fix the one user in OE-Core
of that function which we forgot to migrate.
Fixes: 7c99f90079e7 ("lib/package/utils: Improve multiprocess_launch argument passing") Reported-by: Robert P. J. Day <rpjday@crashcourse.ca> Closes: https://lore.kernel.org/openembedded-core/319bb00c-9712-4aa7-38b0-e1ad2bab840b@crashcourse.ca/ Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oeqa/selftest/liboe: cover oe.path's own path logic
Add in-process coverage for oe.path's join(), is_path_parent(),
symlink(), make_relative_symlink(), canonicalize(), which_wild() and
realpath(), alongside the existing copytree tests.
The cases pin behaviour that is easy to regress: __realpath() falls back
to "not a directory" when os.path.isdir() raises; symlink(force=True)
replaces the literal destination even when its name contains glob
metacharacters, and never removes a pattern sibling; and canonicalize()
skips empty tokens so '', None, and a stray separator do not inject the
current working directory.
realpath() also gets its harder contracts covered: a self-referential
link and an A->B->A cycle both raise ELOOP rather than spinning, a
symlink several components deep still resolves under use_physdir, and a
missing trailing component raises ENOENT by default but is tolerated
with assume_dir=True. symlink() is shown to stage a dangling link whose
target does not exist yet, make_relative_symlink() is exercised several
directories below its target so the multi-level "../" loop runs, and
canonicalize() drops a run of "$" tokens and preserves a trailing slash.
oe/path: canonicalize('') should return '' rather than the cwd
canonicalize() splits its input on the separator and runs each token
through os.path.realpath(). os.path.realpath('') returns the current
working directory, so canonicalize('') and canonicalize(None) wrongly
produced the cwd instead of an empty string, and a stray separator (for
example "a,,b") injected a spurious cwd entry into the result.
Skip empty tokens alongside the existing unexpanded-variable skip so only
real paths are canonicalized.
oe/path: don't glob-expand the destination in symlink(force=True)
symlink(source, destination, force=True) cleared an existing destination
by calling remove(destination). remove() treats its argument as a glob
pattern (it iterates glob.glob(path)), so a destination whose name
contains glob metacharacters is mishandled: a name such as "foo[bar]"
may fail to match itself and be left in place, or a pattern could match
and delete unrelated files.
Remove the literal destination instead: unlink it directly, and fall
back to rmtree() for a directory, ignoring ENOENT. This keeps the
force=True semantics without passing the path through glob.
oe/path: fix bare `false` NameError in __realpath's isdir guard
__realpath() wraps its os.path.isdir() probe in a bare except that
assigns `is_dir = false`. `false` is not a Python name, so when
os.path.isdir() does raise (for example on an ELOOP path), the handler
meant to absorb the error instead raises NameError and aborts the walk.
Use the builtin False so the guard degrades to "not a directory" as
intended.
Peter Marko [Wed, 15 Jul 2026 21:58:51 +0000 (23:58 +0200)]
libxfont: remove recipe
This recipe is obsolete and successor libxfont2 is available.
Nothing in oe-core or meta-openembedded depends on it anymore.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
license: fix list_licenses() crash on CLOSED and empty licenses
oe.license.list_licenses() passes the result of parse_legacy_license()
straight into walk_license(), which unconditionally iterates
node.children. For LICENSE = "CLOSED" (and for an empty license string)
parse_legacy_license() returns None, so walk_license(None) dereferences
None.children and aborts do_package_qa with:
AttributeError: 'NoneType' object has no attribute 'children'
This breaks packaging for every CLOSED-licensed recipe reaching the
obsolete-license QA check.
Guard the walk against a None node, mirroring the existing "if node:"
check in the neighbouring apply_pkg_license_exclusion().
kernel-fit-image: introduce FIT_OS variable to override 'os' field
U-Boot can load an EFI application from a FIT image; this requires
setting the OS to "efi" (usually in combination with type
"kernel_noload"). Doing so is a convenient approach for giving the OS
access to EFI services while preserving other benefits of FIT image boot.
kernel-fit-image: make kernel entry point and load address optional
With image type kernel_noload, these are not used, and with [1] and
[2], U-Boot will not require them anymore for this image type. Allow
omitting them from image generation.
John Ripple [Wed, 22 Jul 2026 20:08:29 +0000 (14:08 -0600)]
go-vendor.bbclass: Run vendor_unlink task under fakeroot
do_install and do_package both run under fakeroot (pseudo), which keeps
pseudo's ownership/inode database in sync with what is actually on disk
under D. do_vendor_unlink runs between them but was never marked
fakeroot, so its os.unlink() of the vendor symlink happened outside of
pseudo's view: the file disappeared from disk but pseudo's database
still held a stale record for that path/inode.
The next fakeroot task to touch that path (do_package) then finds the
on-disk state and pseudo's database disagreeing, and pseudo aborts with
"path mismatch" / "inode mismatch" errors, failing do_package.
Mark do_vendor_unlink fakeroot, matching do_install and do_package, so
its filesystem operations are tracked by pseudo consistently.
Signed-off-by: John Ripple <john.ripple@keysight.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
John Ripple [Wed, 22 Jul 2026 20:08:28 +0000 (14:08 -0600)]
oeqa/selftest: Add go-vendor.bbclass selftest suite
Add govendor.py with two test classes that cover the behaviors fixed and
defined in go-vendor.bbclass:
GoVendorSrcUriTests (offline, ~10 s): unit tests for go_src_uri() parsed
via bb.tinfoil; verifies the basic URI shape, path/pathmajor/subdir/replaces
encoding, and that non-git VCS omits the git-specific nobranch/protocol flags.
GoVendorTaskTests: runs do_go_vendor once against the real recipetool-go-test
project and checks that external deps land in vendor/, *_test.go files are
excluded, pathmajor=/v5 falls back to the repo root when no v5/ subdir exists,
modules.txt is reproduced in vendor/, a local replacement (./is) appears as
a symlink, and the S/src/GO_IMPORT/vendor -> S/src/import/vendor symlink is
created.
Exclude the govendor test recipes from world builds since they are only meant
to be built directly by the govendor test suite.
Signed-off-by: John Ripple <john.ripple@keysight.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
John Ripple [Wed, 22 Jul 2026 20:08:27 +0000 (14:08 -0600)]
go-vendor.bbclass: Fix test file exclusion and license propagation
Two bugs in do_go_vendor:
1. The shutil.ignore_patterns glob was "*._test.go" (with an extra dot),
which never matches standard Go test files (*_test.go). Remove the
extra dot.
2. The license-propagation block used os.path.join(src, "LICENSE") as the
copy destination, writing into the already-processed vendor.fetch source
tree rather than into the vendor destination directory. Switch to
os.path.join(dst, "LICENSE") so the LICENSE lands in vendor/ where go
tools and licence scanners expect it. Also fix the guard condition from
not os.path.exists(subdir) (checking an unrelated relative name) to
not os.path.exists(subdirLicense) (checking the actual target).
Signed-off-by: John Ripple <john.ripple@keysight.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The CVE databases track xmltodict as xmltodict:xmltodict, so the
default python:xmltodict vendor prefix never matches and its CVEs
are not evaluated at all. Use the exact vendor:product pair.
The only existing CVE (CVE-2025-9375, disputed by upstream) affects
0.14.2 before 0.15.1, so it resolves as not affected at 1.0.4.
Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The pypi class default python:pyyaml vendor prefix matches nothing,
so PyYAML CVEs are not evaluated at all. The databases use two
vendor spellings: pyyaml in the NVD CPEs, and "Red Hat" (with a
space, not expressible as a vendor:product pair) in CVE-2020-1747's
CNA record. Use the bare product name to cover both.
All four existing CVEs (CVE-2017-18342, CVE-2019-20477,
CVE-2020-1747, CVE-2020-14343) are fixed by 5.4, so they resolve as
not affected at 6.0.3.
Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
NVD tracks certifi as certifi:certifi, so the default python:certifi
vendor prefix never matches and its CVEs are not evaluated at all.
Use the exact vendor:product pair.
All three existing CVEs (CVE-2022-23491, CVE-2023-37920,
CVE-2024-39689) affect versions below 2026.6.17, so they resolve as
not affected; nothing new shows as unpatched.
Signed-off-by: mark.yang <mark.yang@lge.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Wed, 22 Jul 2026 07:31:37 +0000 (09:31 +0200)]
devtool: recognize perldelta.pod as a changelog file
perl's changelog extraction was picking up dist/Attribute-Handlers/Changes
instead of perl's own release notes. perl bundles dozens of dual-life CPAN
modules under dist/*/{Changes,ChangeLog}, and since perl's own top-level
Changes file is not updated per-release, none of the known
_CHANGELOG_BASENAMES matched the intended file. The extraction fell back to
picking the largest diff among the bundled subcomponent changelogs, which
is unrelated to the perl core changes being upgraded.
perl's actual per-version release notes live in pod/perldelta.pod, which
is large enough to still win the "largest diff" comparison once
recognized. Add it to _CHANGELOG_BASENAMES so it is considered like any
other known changelog filename.
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Thomas Perrot [Wed, 22 Jul 2026 08:24:14 +0000 (10:24 +0200)]
opensbi: bump to 1.9
This release has the following changes.
General:
Initialize stack guard using Zkr extension
Improved irqchip framework to handle wired interrupts and MSIs
Added unit test for string operations
Added NMI support using Smrnmi extension
Added timer events support
Added Vector context save/restore in domain switch
Added Floating-point context save/restore in domain switch
Added Common PMP encoding/decoding helper functions
Added UBSan support
Improved misaligned vector load/store emulation
Platforms:
Added SiFive development platform support
Removed kendryte/k210 platform
Added Tenstorrent Atlantis platform support
Drivers:
Added Andes last level cache controller driver
Added Andes ATCSMU suspend driver
Added Altera JTAG UART driver
Added MPXY client driver for RPMI MM service group
Added minimal SpacemiT I2C driver
Added SpacemiT P1 PMIC reset driver
Added Litex SoC reset driver
Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Tue, 21 Jul 2026 14:48:05 +0000 (16:48 +0200)]
scripts/contrib: add helper to report and fix missing SRC_URI ;tag=
Add a contrib helper which scans parsed recipes for git/gitsm SRC_URI
entries missing a ;tag= parameter. By default it reports only and does
not construct the BitBake fetcher. With --query-remote it queries
upstream tags and, when a well-known tag format resolves to the recipe's
SRCREV, suggests it as a ;tag= candidate. With --write (which implies
--query-remote) the unambiguous candidate is written back to the recipe.
Tag candidate search uses TAG_FORMATS (v${PV}, ${PV}, ${BPN}-${PV})
followed by UPSTREAM_CHECK_GITTAGREGEX if defined in the recipe. A
candidate is only accepted when it resolves to the recipe's literal
SRCREV on the remote, so floating revisions (AUTOREV) and non-release
PVs are skipped.
Writes are performed via oe.recipeutils.patch_recipe(), which also
localises the change to the .inc file when SRC_URI is defined there.
Only literal SRC_URI entries (no ${...} in the URL token) are modified;
the entry is edited with bb.fetch2.decodeurl()/encodeurl() so the
;tag= parameter is appended without disturbing the other parameters.
Every modified file is printed, with a reminder to review the result
with git diff and test it with bitbake -c fetch. With --recipe and
--layer the scan can be restricted to a single recipe or layer, and
--fail-on-missing makes the exit status reflect URLs still missing after
any writes complete.
AI-Generated: Kiro with Claude-opus-4.8 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Wed, 22 Jul 2026 16:47:59 +0000 (18:47 +0200)]
libpng: set status for CVE-2026-40930
Per [1]:
* The vulnerable code originates from the third-party libpng-apng patch,
which adds APNG support to libpng 1.6.x.
* Upstream libpng 1.6.x (without the apng patch) is not affected.
As Yocto never included libpng-apng patch, we can ignore this CVE.
lib/oe/patch: avoid duplicated "From:" in generated patches
To workaround issues with groups.io/list.openembedded.org/lists.yoctoproject.org
rewriting "From:" email header, users are encouraged to put a "From:"
header inside the mail body.
When using the suggested git-send-email workflow, users may use the
git configs format.from=true and format.forceInBodyFrom=true:
man git-config:
> format.from
> Provides the default value for the --from option to
> format-patch. Accepts a boolean value, or a name and email
> address. If false, format-patch defaults to --no-from, using
> commit authors directly in the "From:" field of patch mails.
> If true, format-patch defaults to --from, using your committer
> identity in the "From:" field of patch mails and including a
> "From:" field in the body of the patch mail if different. If
> set to a non-boolean value, format-patch uses that value
> instead of your committer identity. Defaults to false.
>
> format.forceInBodyFrom
> Provides the default value for the --[no-]force-in-body-from
> option to format-patch. Defaults to false.
Putting those configuration locally in every groups.io related
repositories (That means every bitbake-setup repo setup) is tedious, to
avoid that the configuration can be made globally (e.g. in
~/.gitconfig):
$ git config --global format.from true
$ git config --global format.forceInBodyFrom true
... but then it applies to the devtool workspace.
With this configuration, devtool generated patches look like:
|From 4457b9d7805551e6b35efa25f998b63901d4bf86 Mon Sep 17 00:00:00 2001
|From: Yoann Congal <yoann.congal@smile.fr>
|Subject: [PATCH] Add a new line
|
|From: Original Author <author@example.org>
|
|[rest of the patch]
Notice the duplicated "From:" header.
To fix the double "From:" header, use the --no-from option for
git-format-patch to override this configuration and generate only one
"From: Original Author <...>" header.
"--no-from" is the git global default, so this is a noop for users with
default configuration.
Note: The "format.from" configuration is in git since v2.10 (in 2016),
and the --no-from option before that.
Add a new nativesdk packagegroup providing the clang, lld, and
llvm-bin dependencies needed to build external/out-of-tree
modules in the SDK using the LLVM/Clang toolchain.
Rust support in the kernel on riscv64 requires the LLVM/Clang
toolchain rather than gcc, so this packagegroup is intended to
be added alongside nativesdk-packagegroup-sdk-rust when the SDK
targets riscv64.
Add this to TOOLCHAIN_HOST_TASK to include it in the SDK.
Add a new nativesdk packagegroup providing the dependencies needed to
build external/out-of-tree rust modules in sdk.
Set PACKAGE_ARCH to TUNE_PKGARCH instead of the packagegroup
default of "all", since nativesdk-libclang is dynamically
renamed per build (e.g. nativesdk-libclang22.1), which is
incompatible with an allarch packagegroup.
Add this to TOOLCHAIN_HOST_TASK to include it in the SDK.
Introduce packagegroup-core-buildessential-rust to provide the
on-target dependencies required for building Rust-based kernel
modules, including the Rust toolchain, bindgen, and libclang.
Set PACKAGE_ARCH to TUNE_PKGARCH instead of the packagegroup
default of "all", since libclang is dynamically renamed per
build (e.g. libclang22.1), which is incompatible with an
allarch packagegroup.
On riscv64, also pull in clang, lld, and llvm-bin, since rust
support in the kernel on riscv64 requires the LLVM/Clang
toolchain rather than gcc.
Michal Sieron [Fri, 17 Jul 2026 12:53:53 +0000 (14:53 +0200)]
rpcbind: Drop dependency on quota
Originally added to provide rpcsvc/rquota.h header [1], it is no longer
needed since at least v1.2.6 where [2] was merged.
Not sure why, but distros like Arch and Ubuntu (possibly others too) did
not have this dependency at any point from what I could find.
Anyway, this builds just fine without quota present.
The recipe currently always inherits mime-xdg and keeps the installed desktop
files. Add a desktop PACKAGECONFIG option so configurations can disable that
desktop integration while preserving the current default behavior.
When desktop support is disabled, remove the generated desktop files during
do_install and avoid inheriting mime-xdg.
Jörg Sommer [Thu, 16 Jul 2026 20:06:47 +0000 (22:06 +0200)]
base-files: Install /etc/mtab in a systemd-friendly way
The old mtab pointed to /proc/mounts which itself is a symlink. Systemd
therefore tries to replace it with a symlink to /proc/self/mounts, but fails
on a read-only rootfs:
systemd-tmpfiles: symlink(../proc/self/mounts, /etc/mtab) failed: Read-only file system
Signed-off-by: Jörg Sommer <joerg.sommer@navimatix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Upstream isn't clearly communicating their release strategy and plan:
https://www.gnupg.org/download/
In the beginning gnupg 2.5.x were development releases while 2.4.x was
the current maintenance branch. Over time, upstream started to indicate
that 2.5.x should be seen as proper releases, while 2.4.x reached EOL a few
weeks ago. There has not been any communcation about if and when 2.6 appears,
and if it does, will the odd-even version scheme still be followed.
Meanwhile, we do need to pick up the latest 2.5 releases with AUH, so let's drop
the odd-even pretense for now.
Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
On many platforms, the boot time can be reduced by booting without
initramfs. Allow omitting it instead of failing the build when
INITRAMFS_IMAGE is empty.
Ross Burton [Wed, 15 Jul 2026 16:43:51 +0000 (17:43 +0100)]
classes/testimage: capture systemd coredumps on failure
Add /var/lib/systemd/coredump/ to the list of artifacts to save on test
failures, as this is where coredumpctl will write any core dumps that
have occured during testimage.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
projects / thirdparty / openembedded / openembedded-core.git / log
