python_pep517.bbclass: export _PYTHON_HOST_PLATFORM to match our cross-compile target
When the _PYTHON_HOST_PLATFORM environment variable is unset, the value falls
back to the build host architecture, therefore, python wheels get an incorrect
platform tag, setting it as an empty value is also not allowed on python > 3.14.
Set _PYTHON_HOST_PLATFORM as HOST_ARCH dependent so bitbake correctly tags wheels
depending on our cross-compile target, fixing reproducibility issues.
Assisted-by: AI - OpenAI Signed-off-by: Alejandro Hernandez <alhe@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
ptest.bbclass: strip build machine triplet from installed ptest Makefiles
do_install_ptest_base already rewrites HOSTTOOLS_DIR and WORKDIR
references out of installed ptest Makefiles, but automake-generated
Makefiles (as shipped by strace-ptest, gnutls-ptest and others) also
carry six autoconf-generated variables that encode the *build
machine*, not the target:
Those values differ across autobuilder workers (typical values are
build=x86_64-pc-linux-gnu, build_alias=x86_64-linux, build_vendor=pc),
causing corresponding -ptest packages to fail the reproducibility
selftest.
Add sed rules to blank the RHS of each of those assignments, plus the
matching automake helper lines `set build_triplet` and
`set build_alias`, and extend PTEST_BUILD_HOST_FILES to include
site.exp (also autoconf-generated with the same variables).
Verified locally: before this change strace-ptest carried
`build_triplet = x86_64-pc-linux-gnu`, `build = x86_64-pc-linux-gnu`,
`build_alias = x86_64-linux`, `build_cpu = x86_64`,
`build_vendor = pc`, `build_os = linux-gnu`; after this change all six
lines have an empty RHS.
Assisted-by: AI - OpenAI Signed-off-by: Alejandro Hernandez <alhe@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
libtool: strip build system triplet from installed libtool script
The installed /usr/bin/libtool script sourced by any recipe that
inherits libtool contains build_alias=, build= and build_os= lines
populated by config.status with the *build machine's* triplet
(e.g. build=x86_64-pc-linux-gnu, build_alias=x86_64-linux). Those
values vary between autobuilder workers whose config.guess reports
different vendors or OS strings, which makes libtool.rpm non-
reproducible across the autobuilder pool and shows up as a diff in
the reproducibility selftest.
Extend the sanitising sed in remove-buildpaths.inc to blank those
three lines the same way the existing rules blank sysroot and
build-path references.
Verified locally: before this change the installed libtool contained
`build_alias=x86_64-linux`, `build=x86_64-pc-linux-gnu` and
`build_os=linux-gnu`; after this change all three lines are empty.
Assisted-by: AI - OpenAI Signed-off-by: Alejandro Hernandez <alhe@linux.microsoft.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
lttng-tools maintains a branch per minor series (stable-2.11 through
stable-2.16) and tags point releases from it, releasing from more than one
at a time: 2.14.2 and 2.15.1 went out the same day. So upgrades within a
major.minor are stable point upgrades per the OE-Core stable release
policy (ref-manual, "Stable Point Release Upgrades"). There is no written
policy document, so qualification rests on the branch structure and the
release contents below.
Upstream keeps a ChangeLog with a per-release entry list, and all 48
entries for 2.15.1 (Jun 05 2026, against 2.15.0 in February) are fixes,
tests, documentation or refactors. Seven address machine interface output
alone; the rest cover a consumerd lockfile fd leak across fork+exec, a
missing default kernel probe entry, an uninitialised read in uri_compare,
a musl compatibility fix, popt error handling, test fixes, and one
refactor preparing the CPU-mask escaping fix.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone took 2.13.4 -> 2.13.8 and 2.13.8 ->
2.13.9, scarthgap 2.13.11 -> 2.13.13. wrynose has taken none and sits at
2.14.1.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:34 +0000 (16:11 +0200)]
sqlite3: inherit upstream-stable-release-point
SQLite cuts a per-minor maintenance branch for each release series,
branch-3.53 matching the current PV alongside branch-3.52, -3.51 and
-3.50, and tags patch releases off it. Superseded branches keep receiving
them: 3.44.5 and 3.42.1 were released in mid-2025, long after 3.50 was
current. So upgrades within a major.minor are stable point upgrades per
the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades").
Checked the whole current series. 3.53.1 (May 05 2026) through 3.53.4 (Jul
24 2026) are almost entirely memory-safety and corruption-handling fixes:
five out-of-bounds reads, two buffer overreads or overwrites, two integer
overflows, hot-journal rollback with a zeroed super-journal record, safer
double-to-int64 conversion, and mutex acquisition added to a batch of
sqlite3_* entry points. 3.53.0 (Apr 09 2026) opens the series and does add
API surface, confirming X.Y.0 bumps must stay outside the regex.
Two additive exceptions in 3.53.4, neither touching the core library ABI:
the SQLITE_SHELL_EDITION compile-time option for the CLI, and
sqlite3_intck_register() in the incremental integrity-check extension.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone 3.38.2 -> 3.38.3 -> 3.38.5 and
scarthgap 3.45.1 -> 3.45.3. wrynose is at 3.51.3 with no in-series bump
yet.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:33 +0000 (16:11 +0200)]
libgcrypt: inherit upstream-stable-release-point
libgcrypt keeps a long-lived maintenance branch per minor version,
LIBGCRYPT-1.12-BRANCH matching the current PV with equivalents back to
1.2, and releases from several in parallel: in one week of April 2026 it
released into four of them, 1.12.2 and 1.8.13 on the 15th, 1.11.3 and
1.10.4 on the 21st. So upgrades within a major.minor are stable point
upgrades per the OE-Core stable release policy (ref-manual, "Stable Point
Release Upgrades").
NEWS separates "Bug fixes" from "New and extended interfaces", and neither
point release in the current series has the latter section at all: 1.12.2
(Apr 15 2026) is four fixes, including an ECDH buffer overwrite and a
missing Dilithium bounds check, and 1.12.1 (Feb 20 2026) four build or
arithmetic regressions. 1.12.0 (Jan 29 2026) opens the series and does add
features, confirming X.Y.0 bumps must stay outside the regex.
The libtool version-info in each NEWS heading is upstream's own ABI
record, and across the current series only the revision moves. One
deviation is worth disclosing from the previous series: 1.11.2 adds a
single enum constant, GCRY_KEM_RAW_P256R1, with current and age
incremented together so it stays backward compatible. Point releases here
are fixes-focused rather than absolutely fixes-only, with the deviation
bounded to additive constants.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: scarthgap took 1.10.3 -> 1.10.4, which needed a
build fix backported alongside it because 1.10.4 broke building with -O2
in the sysroot path. kirkstone has taken no in-series bump and stays at
1.9.4.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:32 +0000 (16:11 +0200)]
binutils: inherit upstream-stable-release-point
binutils cuts a per-X.Y stable branch, binutils-2_46-branch for the
current series, that takes only bugfixes and backported CVE fixes, and
tags X.Y.Z (Z>0) releases from it. Superseded branches stay alive: one x86
MODRM fix landed on the 2.40, 2.42 and 2.43 branches on the same day in
May 2025. So upgrades within a major.minor are stable point upgrades per
the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades"). This is not spelled out in a policy document, so qualification
rests on the branch structure and the release contents below.
Checked the last two point releases. 2.46.1 (Jun 08 2026) is 137 commits,
mostly automatic version-string date bumps, with six substantive changes,
all fixes: gprof testsuite, build warnings, an sframe encoder/decoder
call-site fix, a DOS-filesystem fix and two linker fixes. 2.45.1 (Nov 10
2025) is aarch64/gas fixes to incorrectly restricted instruction
encodings, linker metadata fixes adding GLIBC_ABI_*_TLS version
dependencies to match glibc's own ABI tags, and libctf, strip and warning
fixes. Neither adds options or instruction support.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone has five or more "binutils: stable
2.38 branch update(s)" commits staying within 2.38.x, scarthgap the same
for 2.42.x, and wrynose has already taken 2.46.1.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:31 +0000 (16:11 +0200)]
openssl: inherit upstream-stable-release-point
OpenSSL's release strategy states that patch releases contain only bug and
security fixes, with no new features and no API or ABI breaking changes.
It maintains several series at once: 3.0.21, 3.4.6, 3.5.7 and 3.6.3 were
all released on 2026-06-09, with 4.0.0 already out. So upgrades within a
major.minor are stable point upgrades per the OE-Core stable release
policy (ref-manual, "Stable Point Release Upgrades").
Checked the last three point releases. Each is labelled "a security patch
release" in its own NEWS.md header, and every entry is a CVE fix, the item
count matching the unique CVE count exactly: 15 CVEs in 3.5.7 (Jun 09
2026), 7 in 3.5.6 (Apr 07 2026), 12 in 3.5.5 (Jan 27 2026).
When a series reaches EOL the regex must be moved to the next maintained
series by hand, as that is a feature-level change.
One limit is worth stating, from this recipe's own history: 3.2.4 -> 3.2.5
was refused on scarthgap in July 2025 for intermittent ptest failures in a
dependent recipe, bisected to an upstream commit and reported upstream,
and the branch went to 3.2.6 instead. A fixes-only release can still fail
to integrate, so proposing an upgrade is not the same as it passing.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone 3.0.2 -> 3.0.19 on the 3.0 LTS series;
scarthgap 3.2.1 -> 3.2.6 then, at EOL, 3.5.5 -> 3.5.7; wrynose picked up
3.5.7.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:30 +0000 (16:11 +0200)]
python3: inherit upstream-stable-release-point
Python maintains each release series on a per-minor maintenance branch
that, once released, takes bug and security fixes only, and it releases
from several at once: 3.10.20, 3.11.15 and 3.12.13 all went out on
2026-03-03, after 3.14.3. So upgrades within a major.minor are stable
point upgrades per the OE-Core stable release policy (ref-manual, "Stable
Point Release Upgrades").
Checked the last three point releases by category, since these are
substantial bug-fix releases rather than security-only. 3.14.6 (Jun 10
2026) has 8 Security, 32 Library and 17 Core entries; 3.14.4 (Apr 07 2026)
has 5, 59 and 46. Every C API entry in both is a fix, so neither adds C
API. 3.14.5 (May 10 2026) is mostly fixes but does add RFC 9309 support to
urllib.robotparser -- one extra capability in one module, touching neither
the language, the C API nor the stable ABI.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone 3.10.4 -> 3.10.20, scarthgap 3.12.3 ->
3.12.13, wrynose 3.14.4 -> 3.14.6.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Daniel Turull [Tue, 4 Aug 2026 14:11:29 +0000 (16:11 +0200)]
libxml2: inherit upstream-stable-release-point
libxml2 maintains per-minor stable branches (2.9 through 2.15) that take
only bug-fix micro releases, and releases from several of them in
parallel: 2.13.9 and 2.14.6 went out the same day, after 2.14.5 was
already out. So upgrades within a major.minor are stable point upgrades
per the OE-Core stable release policy (ref-manual, "Stable Point Release
Upgrades").
Checked the last three point releases. 2.15.3 (Apr 15 2026) is five
security fixes plus an "Improvements" section that is also entirely fixes,
and 2.15.1 (Oct 16 2025) is security, regression and build fixes. 2.15.2
(Mar 03 2026) is five CVE fixes plus one addition, a --xpath0 option
confined to the xmllint command-line tool.
A public-header diff across the three shows zero added, removed or changed
libxml2.so declarations, so the library API and ABI are unaffected by that
addition.
Already tracked this way on the OE stable branches, counting only bumps
since each branch forked: kirkstone picked up 2.9.14, scarthgap 2.12.5 ->
2.12.10.
AI-Generated: Kiro with Claude Opus 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Benjamin Robin [Mon, 27 Jul 2026 08:34:30 +0000 (10:34 +0200)]
spdx_common: In get_patched_src() ensure kernel dir name to be ${BP}
If a kernel recipe is using a tar file instead of git repository, it is
necessary to override `S` to point to the unpacked tar archive.
In this case `${S}` is not going to be in work-shared. So we must handle
this case in get_patched_src() to ensure that the kernel is extracted in
the following path: `${SPDXWORK}/${BP}`.
For a full detailed analysis see [1], but in summary this change is
necessary because:
- In `save_debugsources_info()` the sources are extracted from the debug
symbol. For the kernel Linux the source file path is modified to look
like `${BP}/init/main.c` (`${KERNEL_SRC_PATH}` is replaced by `${BP}`).
- In `get_patched_src()` the sources of the recipe are extracted (again)
in a sub-directory of `${SPDXWORK}`. If `${S}` is in work-shared and if
the recipe inherits the kernel class, then the sources are extracted in
`${SPDXWORK}/${BP}`.
- In `add_package_files()`, with topdir equal to `${SPDXWORK}`, all the
files (recursively) found in topdir are listed. For each source file,
if the file path (relative to topdir) is in the list of source files
retrieved by save_debugsources_info, then the file is added to the SPDX
SBoM.
- If we are using a tar archive, `${S}` is set for example to
`${UNPACKDIR}/linux-${PV}`, so in `get_patched_src()` the sources are
extracted in `${SPDXWORK}/sources/linux-${PV}` since
`UNPACKDIR = ${WORKDIR}/sources`. `${BP}/init/main.c` is not in
`${SPDXWORK}`, but `sources/linux-${PV}/init/main.c` is.
Benjamin Robin [Mon, 27 Jul 2026 08:34:29 +0000 (10:34 +0200)]
spdx_common: modify UNPACKDIR instead of WORKDIR in get_patched_src()
This change will affect the SPDX output: the source file path will no
longer be prefixed by `sources/`.
The rest of the changes are safe because:
- `S` should reference `UNPACKDIR` and not directly reference `WORKDIR`.
- After analyzing all public layers, no `do_unpack()` or `do_patch()` was
found to reference the `${B}` variable. The comment mentioning the
`${B}` variable traces back to [1] (though no further explanation was
provided).
Additionally, this ensures proper capture of sources if the recipe
modifies `UNPACKDIR` outside of `WORKDIR` (though such cases should be
rare).
With these changes, SPDXWORK is no longer a working directory which is
"temporary" replacing WORKDIR, it is now a "temporary" directory containing
unpacked source files.
The run.do_patch.XXXX and associated files are now stored in ${WORKDIR}/temp.
The behavior remains unchanged:
- Instead of saving and restoring the values of various variables, use a
copy of the data store via `d.createCopy()`. This prevents side effects
for other tasks.
- This allows removing the `try ... finally` block.
- The function `is_work_shared_spdx()` no longer needs to be called twice.
- In the work-shared case, there is no need to modify `WORKDIR` since no
task is executed from that branch.
Signed-off-by: Benjamin Robin <benjamin.robin@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Patch 18 adds an option to replace the interpreter in the tzselect
script from /bin/bash to whatever KSHELL is set to. However, patch 19
directly changes the interpreter to /bin/sh so this functionality never
works.
This is further cleanup based on a previous commit removing the KSHELL
assignment[1].
Ross Burton [Thu, 6 Aug 2026 16:27:28 +0000 (17:27 +0100)]
cross-localedef-native: prune patch list
The cross-localedef-native recipe builds on top of glibc and drops in an
autoconf tree to build just localedef. For some reason we're applying a
partial subset of glibc patches that do not impact the localedef build
at all, for example adding documentation or fixing nscd.
Remove patches and other assignments that don't impact the build of
localedef.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Drop 0001-fh_key_file.c-Fix-build-error-for-musl.patch (fixed upstream).
Add patches to fix build failures:
- Fix link error with --disable-nfsdctl (undefined reference to
nfsd_nl_cmd_str)
- Fix musl build (missing stddef.h for offsetof in getport.c)
Both reported to linux-nfs@vger.kernel.org.
Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Thu, 6 Aug 2026 09:14:41 +0000 (11:14 +0200)]
systemd: upgrade to 261.2
Drop two backports that are already in the new version
Changelog for systemd: 261.1 -> 261.2
4925d9f07f meson: bump version to 261.2 70cc4f3d72 escape: reject UTF-16 surrogates in \u escapes in cunescape_one() (#43079) a7bce5b205 homed: verify privileged worker changes f62b9ce4ed man: document that ExitType=cgroup is rejected for Type=oneshot 24ca862cf7 man: update the sample glib/sd-event integration 28c374ef1c man: document unlocked as default IMDS network mode 1192084871 sd-device: allow non-safe characters in uevent files dbfd5d2789 hwdb: classify PlayStation controller audio as controller form-factor 41932924a4 hwdb: strip the root from filenames when generating hwdb.bin 089099b924 man/network: fix default value for RequiredFamilyForOnline= ff395a8c2a hwdb: add debug logging for the output filename 26f3717e27 core/dbus: do not block the manager on GetId during bus (re-)connection dc225cc553 boot: cover BCD offsets past the buffer d8cdc4ee79 password-quality-util-passwdqc: restore password-quality-util.h include 598273bb05 systemd-imds-generator: fix import docs b9a65cb1ba creds: reject empty validity intervals 5158952f96 dissect: include image size in JSON output d4ea8a3061 repart: skip generated files during dry runs eeb244e82c firstboot: validate root shell credentials 431c436a53 sysusers: validate shell credentials d3ebe51c6a docs: clarify scope of portable services c6fc821265 repart: fix varlink description string 484aee1528 network: silence false warning about unitialized variable ef3e2271bd id128: reject app-specific IDs for new 2edfcce6b0 rm-rf: downgrade root check log when directory doesn't exist caa3df83b3 rm-rf: use faccessat instead of fstatat 180baee67d repart: log allocation failure at debug level in Varlink service mode b83eac6ac0 repart: report the actual block device size in currentSizeBytes a315a8afca portable: honor --force for directory extensions 0e4bb54915 portabled: apply pool limits to portable images bcc187363a portablectl: normalize set-limit image paths bf5bf89bd4 portablectl: normalize remove image paths 81e6878669 portable: keep unit symlinks inside the image 4f7c9b77ae portablectl: normalize read-only image paths e67b1bfaf5 portablectl: keep inspect --force unit metadata b05d2790a2 hwdb: update to main@{2026-07-17} b456963bec obs: disable Tumbleweed too 43c416bcd6 units: properly wait for swtpm to finish before the initrd transition b2f01dfed1 units: harden systemd-tpm2-swtpm.service a4badd74aa tpm2: stop the software TPM before the ESP is unmounted on shutdown 160d4f1259 tree-wide: get rid of backslashes in file names 8467a27870 nspawn: use chase() for creating dev nodes c889bcb737 nspawn: log at error level before exiting if parsing OCI fails fe3dbfdf7f boot: fix MEMMAP_DEVICE_PATH EndingAddress field calculation 870d718006 Rebased and reapplied the fix, dropped the test case. 7aa2da940f discover-image: don't ignore symlinks to raw images d392d17143 homed: fix verification of local identity file eb24d74627 machined: Allow user ids in open_shell for machine-dbus c6138ffbdc udev-util: bound leading whitespace skip in udev_replace_whitespace f4c528cb06 string-util: add strnspn() f767359875 sysext: validate work directory metadata before removal 4529bb61d9 shift-uid: close consumed directory fds on early return 9033eae9af rm-rf: fail closed when the root check fails c63b37c0f0 vconsole: reject empty layout during keymap conversion with error fd01077f17 resolved: preserve unchanged question on asymmetric redirect 350d79015d journal-remote: zero-initialize MHD daemon wrapper bd45f60193 journal-remote: remove disabled compression entry before freeing 91796f82de network: cancel netlink calls for detached requests edd08edfe2 network: compare all multipath route nexthops 742bdbb0ea tpm2-util: keep the measurement log's torn-write marker intact 170dab0fe9 journalctl: reject field listing with filters 5e150d2eb5 test: make NSS IPv4 tuple bounds explicit 17dfd608f5 oci-util: Don't fall back to default registry for explicit registries 92ea6ed698 boot: guard missing Windows auto entry 19ce494c58 journalctl: use root machine ID for namespaces 5ab9b61004 tpm2-util: initialize NvPCRs on first extension 6f10261eef sd-dhcp-relay: fix off-by-one when discarding BOOTREQUEST messages by hops count 56958bd945 boot: downgrade EFI_MEMORY_ATTRIBUTE_PROTOCOL warning fdd3966f56 sysupdate: use strverscmp_improved() like everywhere else 2c219d2f09 timedatectl: display RTCTimeUSec in UTC format aa10c21092 network: do not use assert() on a call with side effects 8e10f5f229 dissect-image: don't assert() on partition geometry from blkid 20140670a5 homework-luks: add new key slots before destroying old ones ff4298e73b pull-oci: switch assert() to assert_se() for set_remove() call b5c0959d45 copy: avoid following fifo/node chmod target cb25da37eb log: add upper bound to journal iovec accounting a09c3c523d string-util: add upper bound to ellipsize_mem UTF-8 walks c8e6b02ce6 test: Remove a redundant exit call ddc90bf66c sysupdate: Downgrade an info to a debug log message c8dabc7a90 man: update gpt-auto-generator ESP mounting behavior b8a1d98873 repart: Properly pre-calculate auto size of images 2d75ade520 id128: honor json output for single ids c3ce4a403d boot: allow BCD fields to end at buffer limit e42a4b8be7 portablectl: retry inspect with PORTABLE_PREFIXES 1b23cedff3 string-util: introduce STRING_FILENAME_PART flag for string_is_safe() 87983793db string-util: add STRING_DISALLOW_WHITESPACE for string_is_safe 14648c131e dns-answer: preserve shared aliases when removing records faa89f2c7d resolved: roll back partial DNS zone publication 856f2c88b7 man: clarify that --when= is a lower bound, not a condition 72816231de boot: skip boot counter logic for entries marked read-only 848532980f boot-secret: don't initialize secret mixin file if marked read-only 4c27b10f7f boot: skip random seed handling if seed file is marked read-only eab3959fee run: reject waiting for remain-after-exit services cdc7b3c086 run: reject JSON output with verbose logs c6750b6267 run: reject JSON output in scope mode 1e4abaa22c run: reject JSON output for trigger units 53947cf5a3 run: reject JSON output with stdio forwarding abe01e1a8c run: accept explicit trigger unit names 2e5787eb75 run: reject --ignore-failure in scope mode 3e93ac6e17 run: honor --no-block for trigger units 8f4aa23791 repart: Fix growing the partition preceding a FreeArea from leftover space 6a2db11e2e timer: avoid re-arming WakeSystem=yes timer after suspend 61ed8f7147 resolved: publish browsed service after initialization 49f3d283fd libudev: replace unique list entries in place 48161d0f85 udev/net: reset the config list head in link_configs_free() 3c0f875c76 repart: Don't copy trailing padding when using --copy-from= 377c4e1001 repart: Clarify and test that --copy-from= argument respects grain size 293e44cb09 repart: Don't get old grain size from fdisk for --copy-from= 15b672e8a5 udevadm-trigger: reject invalid wait-daemon timeout 461c203676 udev-config: merge configured children max af2e46c389 man/udevadm: update device-id-of-file arguments c9c847e23d udevadm-settle: reject positional arguments feb767cb60 udevadm-wait: let --removed override initialization 400b796c81 udevadm-info: allow valueless attr filters ac6eb48563 udev: avoid reading before empty capability masks 32fc32a92f test: TEST-89: assert ifindex=0 browse does not flap 72cb20049e ci: check 'update-man-rules' to ensure it is not forgotten e445b27491 resolved: fix spurious BrowseServices add/remove flapping with ifindex=0 8ac83d4f6c nss-myhostname: keep IPv6 probe result stable a6bd0815f5 creds: tolerate TPM2 seal failure in auto mode af1a5b4566 ndisc: reject non-zero ICMPv6 codes in parsers 9d34967b4f pull-oci: verify redirected manifest digest 69a4065ae0 efivars: fix concurrent growth read accounting ebbad7adc9 network: do not regenerate MAC address if already set by userspace 5e1295cb08 obs: explicitly disable Ubuntu/i586 builds f1c1f93118 udev: require exact builtin command matches a7ca71c5a4 include: add hwcaps missing from glibc and musl 7bb32fdcee nspawn-oci: match the spec-correct "swappiness" memory field key 7ac32985fe udevadm-info: handle missing data db cleanup 1da0209142 udevadm-control: reject oversized children-max eca88a543b udev-rules: drop truncated import output line 76f014a083 udevadm-hwdb: honor root when querying ab9695a0b1 udev-rules: accept cvm CONST matches 5df1e9d9f4 import: drop redundant oci-util.c from sources 735ac821c8 dns-configuration: make dns_scope_free() static f36fa3cd91 creds: Use ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR a5231d9ace cryptsetup: Give NV index missing its own error code 5713f1e55e cryptsetup: Skip tokens with JSON parsing errors e8660577a4 cryptsetup: Reduce log level for TPM mismatches 9ccec8367c cryptsetup: Remap bad PCR set early to EPERM 70eb48e1a4 TEST-70-TPM2.cryptsetup: Make sure we iterate over foreign tokens 2424b89f5e tpm2-util: Also report EREMOTE if key is for different parent template 6ff4b985ac tpm2-util: For NV index errors report EREMOTE to be able to continue 793efd3553 tpm2-util: Align tpm2_import with tpm2_load to report on foreign keys 96cc8eecb7 cryptsetup/cryptenroll: Iterate over TPM tokens when they don't match 4d229c8d85 cryptsetup: Report mismatching TPM token error separately 0bd3d0c2e2 stub: Set up all detected consoles a047e14bc8 mount-util/sysext: Clone sub mounts as private to preserve nested ones 2d4b465561 mount-util: Compact list of sub mounts after dropping 434d6e0274 core: make `/run/systemd/first-boot` available earlier df771b177b sysupdate: handle slashes after pattern fields 43a450377b tree-wide: fix some double word errors like "the the" 3b3b4692a8 core: connect to sockets in credential directories 42060d2c30 pcrlock: handle piped PE input 2073a33f0d dissect: do not follow copy-to directory symlinks 86931d2563 stub: Prefer graphical console over virtio detection heuristic 94d7796aef logind: set session->started before seat_read_active_vt() call 723b35b584 journal-remote: do not create /var/log/journal/remote c76ae7a879 mkosi: update arch commit reference to f884cb080300eeb273fb7549fd0aa19bb6142c21 a955daf063 efi-api: validate boot option device path lengths b82a9f9f53 dns-rr: invalidate wire format after changing ttl 872ad58935 tmpfiles: add hardening in glob_item_recursively c4e5f003ed resolved: honour per-link DNSOverTLS=yes for certificate verification 4cff7ce255 sd-event: use CLOCK_BOOTTIME for rate limits bcabc25eb6 creds-util: log when we remove a secret from a different machine 050ff0d62b sd-device: check fd validity before using in sendmsg in test dd01b5bd60 dns-rr: fix SOA JSON fields d51dd5a655 fsck: don't apply invalid mode or repair values c4e0899385 bootctl: Fix prepend when installing systemd-boot for the first time fc4658bc0a sd-bus: voidify bus_match_remove call 9ec5d452f2 measure-smbios: bound type 1 length before zeroing wake-up type ac406e3232 gitignore: add .envrc, .direnv b8522c506f portable: fix marker_matches_images() and propagate errors correctly 138467290f journald: replace existing syslog event source before reopening 626c57b9ba journald: pin the sending client's context across native message dispatch 60cba9ebf8 portable: detect drop-in-only attachments 706c4491ce sbsign: write unaligned signature size into WIN_CERTIFICATE header 775a9e171b pull: honor sync for OCI artifacts 8201bf6977 copy: keep replaced target after publish errors 675f4b0b06 mkosi: update fedora commit reference to 57cbcf979ce2dd872a871c59e87d2c65dfa996e6 589ba40e97 mkosi: update fedora commit reference to 45c16dd369c961b70664e473552def34d5469664 9e41763ec9 resolve: anchor the service browser from mDNS maintenance queries 4744ed0712 network: implement refcounting for SR-IOV objects 0c65971685 udev: clear event back-pointer when freeing a worker c6d35bf4cb sd-bus: drop half-registered vtable members on failure 4a895ab034 sd-bus: re-check match_callbacks_modified in the argNhas value loop c01e2dff1f sd-netlink: disconnect the slot on async/match error paths 9d9774050f network: initialize dot_servers before CLEANUP_ARRAY 16b5fcfa0d udev: track remaining buffer size across $links devlinks 10bc41033c sd-device: avoid 32-bit overflow in the monitor properties bounds check 99d7c6743a hashmap: honor the value destructor in set_ensure_consume() 5867697d6e sd-device: bound the tag filter BPF program size 0826a4a15d logind: drop the seat from the GC queue after draining its devices d65875951e logind: cancel long-press timers when the Button is freed b6a6963e78 logind: don't free live SessionDevice on duplicate TakeDevice 40467642bd boot: require a minimum PE optional header size in verify_pe() b16364d0df boot: restore parent loaded image when initrd registration fails b2644bfe8f boot: restore RW/RO memory attributes on every error 23741dcd57 boot: check PE section against SizeOfImage 0f3dd7ab02 boot: bound PE section VirtualSize before zeroing the inner kernel 1dbedeef33 boot: reject inner kernel entry point outside the image ec6c9360b7 boot: don't unquote an empty value in line_get_key_value() 3b32f046f0 boot: initialize return parameters on zero-length EFI variable read e62dc3e2bf boot: make device_path_next_node() robust against malformed zero-length nodes 0b59b1bd1f test-socket-util: convert to new ASSERT macros 313edfcb48 meson: merge two libelf-related clfags dependencies 30d63ed089 meson: merge three glib cflags dependencies 8e34addf1a meson: do not pass space-separated list of libraries ab892b3e1f meson: use tpm2_cflags dependency rather than tpm2 93f26c6c5d pull: introduce pull-forward.h 2a08e8cb08 sysinstall: Look for valid kernel image before installing e233936dbc boot: reject GPT headers with SizeOfPartitionEntry below the minimum 8eb162df81 machined: drop superfluos 'supervisor' varlink input parameter for register method 0cb4245755 calendarspec: warn on weekday/date conflict in systemd-analyze and systemd-run 387df32dc2 test: ignore fails when the formatted timezone differs from the current one 6fff312839 pcrextend,tpm2-util,tpm2-setup: gracefully skip NvPCR when TPM NV space is exhausted 4f5dcef65d bless-boot: avoid false maybe-uninitialized warning a035cb3445 resolve: fix segfault when built with OPENSSL_NO_DEPRECATED_3_0 1f720ac2dd coredumpctl: use break instead of continue for time bound checks f07d32db0f man: add thread-awareness note to sd_bus/sd_event manpages c12e4a6e28 man: note that sd-tmpfiles/sysusers --root is not a sandboxing feature 3e5fdf2835 vmspawn/nspawn: Always use a per-machine runtime subdirectory 924727469e meson: fix fs.exists() check for fuzz corpus samples 59e87bb61a compress: handle ZSTD_CONTENTSIZE_UNKNOWN when decompressing blobs 97369d584a docs: Update memory pressure docs for latest GLib support for it dc8ce44f48 test: suppress fails on the Africa/Tripoli (Libya) timezone e61272caf1 ukify: show all sections and profiles in inspect JSON output 35178b46b7 test: add test case for show_menu() f99cc27984 terminal-util: drop assert() on 'x' 8a6900b8fe terminal-util: make sure we never go below 10 characters line width 380432f43a terminal-util: use LESS_BY() where appropriate 8f62acc860 terminal-util: calculate array index only once c547cddab9 bpf-restrict-fs: use a 32-bit magic key on big-endian too ce595a30c1 core/scope: don't assert when start is retried during cgroup chown 337cc13d8b core: donate the fdset to do_reexecute() to avoid a double free a8d535fb55 run: refuse --no-block when combined with --scope cfeae2790c shared/install: give the borrowed name back before bailing on error 7d0f473cb9 quotacheck: don't apply an invalid quotacheck.mode= value c4fe868f7b core: avoid using uninitialized buffer on bad systemd.random_seed= 256465f3f7 tree-wide: fix return type of sysconf() cce527de38 memory-util: don't use 'r' for non-int returns c9248545a5 build(deps): bump the actions group with 6 updates 8d8f9c1e39 man: update description for sd_device_enumerator_add_match_subsystem 9836c4ab8c test: reduce number of disks in TEST-64-UDEV-STORAGE-simultaneous_events on Debian/Ubuntu de01a0f78f sd-journal: rate-limit tail timestamp refresh during iteration 2db85c4e1c man: fix wrong KillUserProcesses= default in systemd-run(1) 114df0eeab ptyfwd: avoid touching forwarder after exit drain 3c06c9e4ad boot/random-seed: create \loader\ dir if missing when seeding 903f1d1dc6 env-util: ensure NUL termination of the replace_env_argv() output array 9d3da650d0 fido2: reject zero-length HMAC secret 2674591913 ssl-util: set log level to debug in dlopen_many_sym_or_warn() 80f8a1124a resolvectl: fix JSON reply cleanup in varlink_dump_dns_configuration a22d428609 exec-invoke: fix wrong errno in log_error_errno for setenv failure b9ec917f14 crypto-util: set log level to debug in dlopen_many_sym_or_warn() 26916eda27 luo-util: use new LIVEUPDATE_SESSION_GET_NAME ioctl to get session name if available 8b45e907e7 Import linux/liveupdate.h UAPI header from 7.2-rc1 d76499f0b4 portable: leave room for trailing NUL in metadata receive buffer ae34b3441d man: document that $XDG_CONFIG_HOME affects environment.d lookup path 14ec524c1f shared/varlink: fix license of varlink-io.systemd.Udev.c eeb5862a0b test: drop ASAN workaround in TEST-07-PID1.issue-14566 cc0c446e10 test: use /run/ for temporary files in TEST-07-PID1.issue-14566 5827c35fd8 test: make TEST-07-PID1.issue-14566 more robust 5323aefd49 mkosi: fix license of mkosi.finalize 2bb7b1ae7c shell-completion: add missing commands and options to timedatectl zsh 1fc65de3b4 tmpfiles: fix device node major:minor logging to use i->major_minor dd6c1c63de logind: fix typo in reboot-to-boot-loader-entry path b8418ff33a journal-verify: fix offset reported for tail hash mismatch 38d246a627 tmpfiles: propagate clean_item_instance() error in clean_item() df9ffa2309 Correct allocation size computation in xescape_full 71fc09c47e vmspawn: complain loudly if we can't prepare a unix socket for virtiofsd 06f2b81cc9 mkosi: pull new split-out packages for deb/ubuntu 73b089c099 journal-importer: avoid false maybe-uninitialized warning cc674bbeca test: relax grep for DNS query refusal 6a5feb213e sd-json: Fix validation of optional fields within a mandatory struct 1e133c189e man: fix first argument in Environment= expansion example 0f1a2cde63 mkosi: update debian commit reference to 8e947316488c163321665a60766dbc972e9edf7a
Ross Burton [Wed, 5 Aug 2026 11:36:34 +0000 (12:36 +0100)]
python3-packaging: upgrade 26.2 -> 26.3
- Add a public VersionRange API and SpecifierSet.to_range(),
representing the versions a specifier set accepts as an interval set
that supports intersection, union, difference, complement, set
relations, membership tests, and filtering.
VersionRange.to_specifier_set() converts a range back to a
SpecifierSet where a PEP 440 form exists.
- PEP 808: accept Metadata-Version: 2.6.
- Add a limit argument to parse_tag() for compressed tag sets.
- Add a prefer_sdist_predicate argument to Pylock.select() to prefer
source distributions over wheels for selected packages.
- Add pure_python_tags() to generate the pure-Python tags for a Python
version without touching the running platform.
- Add SpecifierSet.is_subset(), SpecifierSet.is_superset(), and
SpecifierSet.is_disjoint(), which compare the versions two specifier
sets accept.
- Drop support for Python 3.8; packaging now requires Python 3.9 or
later.
- Prefer native linux_* platform tags over manylinux and musllinux tags
on Linux. - Add a musl/Alpine test job and make the test suite pass on
musl.
The tests now work on musl so don't skip the manylinux tests.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oe-selftest: devtool ide-sdk: add test for ide=none LLDB/clang support
Add test_devtool_ide_sdk_none_cmake_clang to DevtoolIdeSdkTests to
exercise the new LldbServerConfigNone code path in ide_none.py.
The test uses the cmake-example-clang recipe (TOOLCHAIN = "clang") and
runs devtool ide-sdk with --ide=none. It verifies:
- lldb_server_<port>_<binary>_multi script is generated
- lldbinit/lldbinit_<port>_<binary> init file is generated
- lldb_<port>_<binary> wrapper script is generated
- No gdbserver_* script is generated for a clang recipe
- The install_and_deploy script exists
- The oe-scripts symlink inside the source tree is valid
- lldb-server can be started on the target via the generated script
- The pid file written by the start script references the live process
- An lldb --batch session using the generated wrapper reaches main and
can evaluate CppExample::test_string at the breakpoint
- lldb-server stops cleanly via the generated stop script
A new helper _lldb_none_debugging_multi is added alongside the
existing _gdb_cross_debugging_multi, following the same structure.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Add test_devtool_ide_sdk_code_cmake_clang to verify the full devtool
ide-sdk workflow for a cmake recipe built with clang. Unlike the gcc
variant the clang recipe uses lldb-server for remote debugging and
CodeLLDB (vadimcn.vscode-lldb) as the VS Code debug adapter.
The test covers:
- devtool modify + devtool ide-sdk with ide=code
- cmake preset compilation and CTest execution (same as the gcc test)
- extensions.json recommends vadimcn.vscode-lldb
- launch.json uses "type": "lldb" (CodeLLDB) instead of "type": "cppdbg"
- End-to-end lldb --batch remote debugging session via lldb-server
platform mode running on qemu
Supporting changes:
- _write_bb_config: accept optional extra_packages parameter so the
clang test can add lldb-server to IMAGE_INSTALL
- _verify_launch_json_lldb: new helper that validates the CodeLLDB
launch.json structure (type, initCommands, program, cwd, preLaunchTask)
- _lldb_server_debugging_once: new helper that reads the preLaunchTask
SSH command from tasks.json, starts lldb-server on the target, and
runs lldb --batch to verify a breakpoint at main is hit
- _verify_service_running: use pgrep with exact regex (^name$) for exact
process name matching; without that, pgrep would also match
cmake-example-clang (truncated to 'cmake-example-c' in
/proc/pid/comm) when checking for cmake-example, returning two PIDs
and failing the isdigit() assertion
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
meta-selftest: refactor cpp examples into .inc files and add clang variants
Refactor cmake-example.bb and meson-example.bb to extract common
build logic into separate .inc files. Add clang variants of both
examples to enable testing with alternative toolchains.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: ide-sdk: add LLDB support for ide=none (clang toolchain)
Bring ide=none to feature parity with ide=code for clang recipes by
adding LldbServerConfigNone and dispatching on the toolchain in
IdeNone.setup_modified_recipe.
Three files are generated per binary when toolchain == 'clang':
lldb_server_<port>_<binary>_<mode>
Shell script with start/stop logic (same pattern as the existing
gdbserver_* scripts). Passes the lldb-server SSH command produced
by LldbServerConfig._target_start_cmd, which already includes the
/proc/net/tcp readiness poll for MULTI mode.
lldbinit/lldbinit_<port>_<binary>
Init file sourced by lldb via -s. Sets up the remote platform
connection, source maps, debug-file-search-paths and
exec-search-paths, then creates the target with
"target create --remote-file <target_path> <host_debug_binary>".
lldb_<port>_<binary>
Wrapper script: cd <srctree> && lldb -s <lldbinit> "$@"
Supporting changes:
LldbServerConfig (ide_plugins/__init__.py): add server_script_file /
server_script, which were left as NotImplementedError in the base
class. Required for LldbServerConfigNone to write its start scripts
to the correct paths.
RecipeLldbNative (ide_sdk.py): rename _lldb -> lldb (plain attribute),
matching the RecipeGdbCross.gdb convention so that ide_none.py can
access the host lldb binary path without going through a property.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: ide-sdk add LLDB support for clang toolchain
Add support for LLDB (CodeLLDB) remote debugging in VSCode when using
the clang toolchain. This includes:
- New LldbServerConfig class for configuring lldb-server on the target
- LldbServerConfigVSCode for VSCode-specific LLDB configuration
- RecipeLldbNative to handle lldb-native (architecture-agnostic) on the
host
- CodeLLDB VSCode extension recommendation for clang toolchain
- Launch configuration generator for LLDB debugging
- Proper handling of source maps and debug symbol paths for LLDB
Meson/ninja invoke the compiler with source paths relative to the build
directory B, rather than absolute paths. -fdebug-prefix-map and
-ffile-prefix-map only rewrite paths that literally start with the
mapped host prefix, so this relative DW_AT_name is never rewritten;
only the absolute DW_AT_comp_dir is. When resolving the compile unit
path, debuggers join comp_dir with the relative name, popping one
component per leading "..". In devtool workspaces the source directory
S is relocated far away from the build directory B (outside WORKDIR),
so DW_AT_name typically contains more ".." components than comp_dir
has path components. Once the join reaches "/", extra ".." are no-ops,
so the resolved path becomes "/" plus the leftover suffix of DW_AT_name
- a suffix of the real absolute source directory, not the
"/usr/src/debug/<pn>/<pv>" prefix that DEBUG_PREFIX_MAP and the
generated sourceMap assume.
Compute this "broken" resolved suffix for the recipe's own source
directory and use it instead of the original comp_dir-based mapping.
Keeping both mappings would point two different debug-info paths at
the same host path, which is ambiguous when CodeLLDB needs to reverse
the mapping (translating a locally opened file back into a debug-info
path to resolve a breakpoint): it picks the first-registered
("normal") mapping, which never matches any real compile unit here,
leaving breakpoints stuck pending with 0 locations.
Also set launch.json's relativePathBase to the build directory B, so
CodeLLDB resolves any source path that is still relative (i.e. not
covered by sourceMap/target.source-map) against B - the compiler's
working directory - instead of the default ${workspaceFolder}, which
does not necessarily match B in devtool workspaces.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: ide-sdk: wait for gdbserver port before returning
In MULTI mode, gdbserver is started as a background process and the SSH
command returned immediately, leaving a race between the caller
connecting to gdbserver and gdbserver finishing its bind()/listen()
sequence.
The race condition was observed with lldb-server not with gdbserver, but
it is likely to affect both. It might be a fix for gdbserver as well,
but at least it is a preparatory step for adding LLDB support, which is
the next planned item.
There are two possible synchronisation points:
- The pid file: written by the shell immediately after fork(), before
gdbserver has called bind() or listen() — not useful as a readiness
signal.
- /proc/net/tcp: the port entry appears after remote_prepare() completes
socket()+bind()+listen(), which is the earliest point at which
gdbserver will accept a connection.
Replace the pid-file idempotency check with a /proc/net/tcp port check
so that:
- the SSH command doubles as a readiness probe (exits only when
gdbserver is actually listening, or after a 10 s timeout with exit 1)
- re-running the start command while the server is already up is still
a no-op
The VSCode task for MULTI mode is changed accordingly: since the SSH
command now exits as soon as the server is ready, VSCode no longer
needs isBackground + a pattern matcher — a plain task with an empty
problemMatcher suffices.
The pid file is still written so that the stop script can kill the
server by PID.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Refactor the devtool ide-sdk support for remote debugging with
gdbserver. The main goal is to cleanly separate the generation of the
host-side debugger configuration (gdbinit, wrapper scripts) from the
IDE-specific launch/task config generation, and to provide a common
interface for supporting multiple debug server back-ends (gdbserver,
lldb-server) in the future.
Also: skip building gdb-cross for clang-toolchain recipes
(toolchain == 'gcc' guard). Clang recipes will use lldb-server instead
of gdbserver in the future. For gcc recipes the behaviour is unchanged.
Also fix a typo in the GDB configuration generator where the property
was named "is_c_ccp" instead of "is_c_cpp".
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
oe-selftest: devtool ide-sdk: add real debug coverage for meson+code
test_devtool_ide_sdk_code_meson never booted qemu-system (missing
@OETestTag("runqemu") and runqemu()), passed a hardcoded, non-existent
target address (root@192.168.17.17), and only checked _gdb_cross()
(gdb-cross --version). It never validated the generated launch.json
nor performed an actual remote debugging session, unlike its cmake
sibling test_devtool_ide_sdk_code_cmake.
Bring it to parity with test_devtool_ide_sdk_code_cmake: boot
qemu-system, use the real qemu.ip as target address, and call
_verify_launch_json() plus _verify_launch_json_debugging() to exercise
a genuine gdbserver-based debug session through the generated
launch.json/tasks.json. This closes the last gap in the 2x2 matrix of
build system (cmake/meson) x ide mode (code/none): all four
combinations now have real breakpoint-debugging coverage.
_verify_launch_json_debugging() matched the 'once' debug configuration
by looking for "usr-bin-{recipe_name}_once" in its name. But the
config name is derived from the binary's install path, so it is
"usr-bin-{example_exe}_once". This happened to work for cmake-example,
where the binary name equals the recipe name, but not for
meson-example, whose recipe name is 'meson-example' while the
installed binary is 'mesonex'. Match on example_exe instead, and drop
the now-unused recipe_name parameter.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
oe-selftest: devtool ide-sdk: cover breakpoints in exe, header and library
_gdb_debug_cpp_example() already set breakpoints in the executable
(cpp-example.cpp, by file:line) and the library (CppExample::print_json()
in cpp-example-lib.cpp, by symbol), plus a 'list' (not a breakpoint) of
the test_string declaration in the shared header cpp-example-lib.hpp.
There was no actual breakpoint set on code that lives in the header
itself, and no file:line breakpoint set inside the library's own .cpp
file.
Add CppExample::scale_number(), a trivial inline function defined
directly in cpp-example-lib.hpp (not in a .cpp file), and call it from
cpp-example.cpp's std::vector traversal loop. Set a breakpoint on it by
file:line (cpp-example-lib.hpp, conditioned on n == 1 since the loop
calls it once per vector element) and verify it is hit with the
expected value.
Also set a second, file:line breakpoint directly inside the library's
own print_json() body (cpp-example-lib.cpp), in addition to the
existing symbol breakpoint on print_json() itself. A symbol breakpoint
only needs the function's entry address and resolves the same whether
the debugger picks up stale or freshly rebuilt debug info for the
library, since it doesn't rely on the library's own line-to-address
mapping being fresh; a file:line breakpoint does, making it the only
breakpoint in this test that actually exercises solib-search-path debug
info resolution for the library.
The second _gdb_cross_debugging_multi() call (after the code
change/recompile/redeploy cycle) originally reused the exact same
file:line breakpoints as the first call. A stale/incorrect
line-to-address mapping left over from the previous build could in
principle still resolve to a plausible address at the same line
number, without that being noticed. To close that gap, parameterize
the exe, header and library file:line breakpoints
(exe_break_line/exe_list_line/hpp_break_line/lib_break_line) through
_gdb_debug_cpp_example(), _gdb_debug_cpp_example_check() and
_gdb_cross_debugging_multi(). Insert LINE_SHIFT (3) extra lines right
before the targeted statements in cpp-example.cpp,
cpp-example-lib.hpp and cpp-example-lib.cpp as part of the existing
code-change step, and use the shifted line numbers for the second
debug session.
Together, this exercises breakpoint resolution for header-only debug
info, the executable's own file:line breakpoint, the library's symbol
breakpoint and the library's own file:line breakpoint as distinct code
paths, and proves all of them are resolved against the freshly rebuilt
debug info after a recompile/redeploy, rather than a stale/cached
mapping from the previous build.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
devtool: deploy-target: fix run strip under pseudo
Any file modification on pseudo-tracked files must happen inside the
pseudo fakeroot environment so the pseudo database stays in sync with
the real filesystem. Stripping was done outside pseudo, which is
conceptually wrong: tools that replace files (temp+rename) change
inodes, and pseudo loses track of the new inodes, causing the
deployment tar to embed incorrect ownership and permissions.
This probably went unnoticed because GNU strip modifies files in place without
changing their inodes. llvm-strip replaces files via a temp file and
rename, making the ownership corruption visible.
The old code was manually prepending path to the parent process's PATH
so strip_cmd could be found, then restoring it. The new code passes the
strip script to exec_fakeroot_no_d, which already sets PATH = path in
the subprocess's environment — so strip_cmd is findable there without
touching the parent's PATH at all.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Harish Sadineni [Wed, 5 Aug 2026 17:46:39 +0000 (10:46 -0700)]
kernel-yocto-rust: Add clang toolchain check for riscv64
Rust support in the upstream kernel on riscv64 currently requires the
LLVM/Clang toolchain and does not work with gcc [1]. Add a sanity check to skip
the recipe if TOOLCHAIN is not set to "clang" when building a riscv64 kernel with
rust support enabled, point the user to the local.conf change needed to fix it.
Peter Marko [Wed, 5 Aug 2026 18:38:45 +0000 (20:38 +0200)]
libarchive: set status for CVE-2026-4424
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
These are RedHat CVEs listing version-less or distro versions.
Release 3.8.7 notes [1] contain reference to pull [2] from NVD report.
Peter Marko [Wed, 5 Aug 2026 18:38:44 +0000 (20:38 +0200)]
gnutls: set status for CVE-2026-42010 and CVE-2026-42010
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
These are RedHat CVEs listing version-less or distro versions.
These CVEs are listed in commit upgrading to 3.8.13.
Also Debian CVE reports link commit in this release.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Wed, 5 Aug 2026 17:28:40 +0000 (19:28 +0200)]
ppp: set status for CVE-2020-15704
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
Peter Marko [Wed, 5 Aug 2026 17:28:39 +0000 (19:28 +0200)]
openssl: set status for CVE-2015-3216
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
Peter Marko [Wed, 5 Aug 2026 17:28:37 +0000 (19:28 +0200)]
pulseaudio: set status for CVE-2020-15710 and CVE-2020-16123
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
Peter Marko [Wed, 5 Aug 2026 17:28:36 +0000 (19:28 +0200)]
ovmf: set status of CVE-2017-5731 and CVE-2019-14584
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
OVMF has a generic problem that version is encoded in different ways.
Both CVE have their fixed version in NVD CVE reports encoded as
YYYY-MM-DD...
CVE-2017-5731 additionally predates tags in vurrent git repository.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Peter Marko [Wed, 5 Aug 2026 17:28:35 +0000 (19:28 +0200)]
glibc: set status for CVE-2011-0536 and CVE-2025-0577
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
* CVE-2011-0536: CVE desciption says it's related to RedHat patches
* CVE-2025-0577: [1] linked CVE report says it's related to RedHat
patches and no upstream release is impacted
Peter Marko [Wed, 5 Aug 2026 17:28:34 +0000 (19:28 +0200)]
gnutls: set status for CVE-2023-0361
New version of sbom-cve-check makes more torough version validation
and version strings with distro specific suffix is no longer accepted,
thus leaving some CVEs without version to compare (no-version-ranges).
EGLIBC_KNOWN_INTERPRETER_NAMES is assigned in glibc-ld.inc, and then
in do_patch() the magic string OECORE_KNOWN_INTERPRETER_NAMES is replaced
with its value.
OECORE_KNOWN_INTERPRETER_NAMES was removed in the glibc 2.37 upgrade[1]
as the relevant code was removed from glibc[2], so this is now obsolete
and can be removed.
[1] oe-core 1bba40755c8 ("glibc: Upgrade to 2.37 release")
[2] glibc 8ee878592c ("Assume only FLAG_ELF_LIBC6 suport")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Wed, 5 Aug 2026 16:03:20 +0000 (17:03 +0100)]
glibc: remove obsolete KSHELL assignment
KSHELL was set so that tzselect uses /bin/sh instead of /bin/bash.
This variable doesn't exist in glibc and instead we patch the script in
0019-tzselect.ksh-Use-bin-sh-default-shell-interpreter.patch, so we can
remove this assignment.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:59 +0000 (17:57 +0100)]
rust: clean up dependencies
The rust recipe inherits cargo_common which now depends on rust-native
and cargo-native, so we can just remove those dependencies in the native
case instead of having to handle target/nativesdk.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:58 +0000 (17:57 +0100)]
classes/cargo: consolidate dependencies
Move the dependencies from cargo to cargo_common: if cargo is being used
in any way then you need to depend on cargo-native.
Inherit rust instead of rust-common or rust-target-config: rust inherits
rust-common that inherits rust-target-config, and rust.bbclass simply
adds the dependency on rust-native. This means we can drop the explicit
rust dependencies to avoid duplication.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:57 +0000 (17:57 +0100)]
classes/cargo: move general assignments to cargo_common.bbclass
The cargo integration is split into two classes so that recipes can
inherit cargo_common if they can't use cargo directly to build, for
example when using meson+cargo or building rust itself.
However, a number of variables where in cargo.bbclass when they should
really be in cargo_common.bbclass: move the assignments so that the
cargo.bbclass simply inherits cargo_common, sets B, and implements the
compile/install tasks.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:56 +0000 (17:57 +0100)]
classes/rust: remove unused variables
RUSTC_ARCHFLAGS is never passed anywhere, remove it.
RUSTC_BUILD_LDFLAGS is commented out, remove it.
HOST_CFLAGS et al are assigned to the CFLAGS for convenience, but are
not used anywhere and the same values are exported in cargo_common's
oe_cargo_fix_env().
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 16:57:55 +0000 (17:57 +0100)]
classes/cargo_common: move PKG_CONFIG_ALLOW_CROSS export to oe_cargo_fix_env
This export is used to tell the pkg-config-rs crate how to behave, so is
only needed at build time. Move the export to oe_cargo_fix_env() along
with the other variables so that the exports are localised and not
global.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Tue, 4 Aug 2026 15:44:51 +0000 (16:44 +0100)]
libjpeg-turbo: use system zlib instead of bundled copy
The libjpegturbo library bundles a copy of libspng which in turn bundles
a copy of zlib. We don't currently have a libspng recipe but we can
stop it bundling zlib.
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Daniel Turull [Tue, 4 Aug 2026 06:02:03 +0000 (08:02 +0200)]
devtool: upgrade: ignore changelogs from 3rd party
Some upstream projects bundle vendored dependencies in their source
tree (e.g. nghttp2 ships third-party/mruby, which has its own
NEWS.md). The changelog extractor could mistake one of these
vendored changelogs for the recipe's own, misattributing unrelated
upstream changes to the package being upgraded.
Exclude paths under common vendoring directory names (third-party,
vendor, external, deps, etc.) from changelog candidates.
AI-Generated: Kiro with Claude Sonnet 5 Signed-off-by: Daniel Turull <daniel.turull@ericsson.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
oeqa/selftest/clang: Add oe-selftests for Clang/LLVM/LLD test suites
Add three selftest classes (LLVMSelfTestSystemEmulated,
ClangSelfTestSystemEmulated, LLDSelfTestSystemEmulated) that run
the upstream LLVM, Clang, and LLD regression test suites on target
using llvm-lit inside QEMU.
Each test:
- Automatically sets CLANG_ENABLE_TESTSUITE = "1" to enable
testsuite CMake flags and target tool installation
- Builds core-image-minimal with Python3 and LLVM dependencies
- Boots QEMU with 8GB RAM / 4 CPUs (3GB for 32-bit ARM)
- NFS-mounts the host TMPDIR into the guest to access build
artifacts (lit configs, test inputs, and target tools)
- Runs llvm-lit with filters to exclude tests for non-target
architectures and unsupported OS platforms
- Excludes known-failing tests specific to each component
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
clang: Enable cmake flags for llvm, clang, lld tests
Enable the necessary CMake flags to build and run tests
for LLVM, Clang and LLD. Install the LLVM target tools
needed to run tests via llvm-lit inside QEMU only when
CLANG_ENABLE_TESTSUITE = "1".
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
clang-tools-extra tests depend on the llvm-bcanalyzer CMake target, which
exists in LLVM's CMake project but is not visible when Clang is built
separately. To run clang tests, disable clang-tools-extra tests for now.
Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 3 Aug 2026 09:47:17 +0000 (10:47 +0100)]
classes/setuptools_build_meta: clean the build directory in configure
It's not currently possible to set the build tree to be somewhere we
control, but we know it will always be in the build directory alongside
the setup.py so we can [cleandirs] that.
Essentially the same as the previous patch for the setuptools class[1],
but when using the pep517 class.
[1] oe-core f3854f4f608 ("setuptools3: clean the build directory in configure")
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Xiuzhuo Shang [Mon, 3 Aug 2026 03:05:07 +0000 (11:05 +0800)]
bluez5: restrict delta=0 RSSI to proximity filters
When a discovery filter is active (filtered_discovery=true), BlueZ
unconditionally calls device_set_rssi_with_delta(..., delta=0),
causing every BLE advertisement to emit a PropertiesChanged(RSSI)
signal regardless of whether the RSSI value changed.
delta=0 is only needed when a client has expressed explicit proximity
interest by setting an RSSI or pathloss threshold in its discovery
filter. Filters that specify only transport type or UUIDs do not
require per-packet RSSI precision; for those, the standard
RSSI_THRESHOLD=8 rate-limiting is both correct and desirable.
Signed-off-by: Xiuzhuo Shang <xiuzhuo.shang@oss.qualcomm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
cvelistV5 has correct version identification, so CNA (SUSE) has it
correct, too.
NVD however shows non-existing version 21.2.24 (probably from CVE
description), so it's showing up in reports as unfixed.
Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The generated meson.cross references the toolchain c/c++ binaries by
bare name (e.g. "aarch64-poky-linux-clang++"), relying on PATH being
set up by the meson wrapper script at build time. Meson stores that
command exactly as configured in compile_commands.json and
meson-info/intro-compilers.json without resolving it to an absolute
path. cpptools (via the mesonbuild extension) resolves compilerPath
using its own process PATH, which does not include the toolchain
directory, and silently falls back to a host compiler, breaking
IntelliSense.
Real builds are unaffected since the wrapper script sets up PATH at
build time, so leave the recipe's meson.cross untouched. Instead,
layer an extra --cross-file on top that only absolutizes the c/cpp
[binaries] entries, reusing the exact same flags as CC/CXX to avoid
any behavior drift. Meson merges multiple machine files, with later
files overriding matching keys from earlier ones.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
devtool: ide-sdk: fix $@ overwritten by set in install_and_deploy script
The generated install_and_deploy shell script uses 'set $BUILDDIR $BITBAKEDIR'
to pass arguments to oe-init-build-env. This overwrites $@, so the original
command-line arguments (e.g. -t user@host -P 2222) are lost before the
embedded deploy script can read them.
Save the original arguments in $_args before the 'set' call and pass
$_args to the deploy script instead of $@.
Extend the argument-parsing loop in the embedded Python deploy script to
handle -P/--port in addition to -t/--target, so that non-default SSH
ports are forwarded to devtool deploy-target.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
devtool: ide-sdk: fix duplicate -p flag in _target_ssh_args
ssh_port is stored as ['-p', '<port>'] (already includes the flag).
_target_ssh_args was wrapping it in another list with a leading "-p",
producing invalid ssh args like ["-p", ["-p", "2222"]].
Extend ssh_args directly with ssh_port instead of nesting it.
Also pass --port to the install-and-deploy task in the generated VS Code
configuration so the task reaches the target on non-default SSH ports.
Signed-off-by: Adrian Freihofer <adrian.freihofer@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 20:18:21 +0000 (21:18 +0100)]
libunwind: Disable cxx exceptions for riscv64
With the newer libtool, libunwind fails to build on riscv64 with an error
about the WCClinker option. Disable those exceptions until a better fix
is identified.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Markus Volk [Mon, 3 Aug 2026 13:49:15 +0000 (15:49 +0200)]
libva: update 2.23.0 -> 2.24.1
version 2.24.1
va: include <unistd.h> for getuid/getgid in secure_getenv fallback
version 2.24.0
va: Add VA_PICTURE_H264_NON_EXISTING flag
va: use secure_getenv instead of getenv in va_x11.c
doc: fix libva av1 link for doxygen
trace: dump input/output data in va_TraceProtectedSessionExecute
trace: Add ProtectedSession Related Log in Trace
Signed-off-by: Markus Volk <f_l_k@t-online.de> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Mon, 3 Aug 2026 23:26:41 +0000 (16:26 -0700)]
Revert "python3-websockets: enable ptest"
The tests/ are no longer packaged in the sdist and this is intentional:
https://github.com/python-websockets/websockets/issues/1739#issuecomment-5016084799
"You mustn’t rely on the git repository as input. Specifically, you
mustn’t attempt to run the main test suite. It isn’t treated as a
deliverable of the project. It doesn’t do what you think it does. It’s
designed for the needs of developers, not packagers.
On a typical build farm for a distribution, tests that exercise timeouts
will fail randomly. Indeed, the test suite is optimized for running very
fast, with a tolerable level of flakiness, on a high-end laptop without
noisy neighbors. This isn’t your context."
* Restored compatibility of serve_forever() in the asyncio implementation
with third-party event loops such as uvloop.
* Prevented the Trio implementation from crashing when backpressure kicks
in, i.e. when receiving data faster than the application can process it.
* websockets 17.0 requires Python ≥ 3.11.
- websockets 16.1 is the last version supporting Python 3.10.
* Aliases for modules moved or deprecated in 9.0 are removed.
- See the changelog of version 9.0 for details.
* process_request may receive requests using an HTTP method other than
GET or using the HTTP/1.0 protocol.
- Previously, the server closed the connection without returning an HTTP
response. Now, process_request runs and can return an HTTP response.
* Several boolean arguments are now keyword-only.
- If you were passing some of the following as positional arguments, you
must update your code to pass them as keyword arguments.
* send(text=...)
* ping(ack_on_close=...)
* broadcast(raise_exceptions=...)
* Encoding and decoding non-ASCII headers in handshake requests and
responses changed.
- The previous behavior was undocumented, inconsistent, and didn’t match
the HTTP specification. If you relied on the encoding being UTF-8 or
ASCII with surrogate escapes, depending on the context, you must
switch to ISO-8859-1.
* In the threading implementation, the socket argument is renamed to sock.
- The first argument of ClientConnection and ServerConnection is renamed
from socket to sock for consistency with connect() and serve(). The
first argument of Server is also renamed. If you’re passing it as a
keyword argument, you must change your code.
New features
------------
* websockets 17.0 introduces a trio implementation.
- It is an alternative to the asyncio implementation.
- See websockets.trio.client.connect()
and websockets.trio.server.serve() for details.
* Validated compatibility with Python 3.15.
* Added broadcast() to the threading implementation.
* Made the set of active connections available in the Server.connections
property in the threading implementation.
* Closed connections when shutting down the server in the threading
implementation. See shutdown() for details.
* Added the --insecure option to the websockets CLI to disable TLS
certificate validation.
Improvements
------------
* Supported non-ASCII headers consistently in handshake requests and
responses, using ISO-8859-1 encoding.
* Replied with HTTP 405 Method Not Allowed when the handshake request
doesn’t use the GET method, and with HTTP 505 HTTP Version Not
Supported when it doesn’t use HTTP/1.1, instead of closing the
connection.
* Replied with HTTP 414 URI Too Long or 431 Request Header Fields Too
Large when the handshake request exceeds a security limit, instead of
closing the connection.
* Reduced noise in server logs when clients fail to establish a
connection.
* Clarified logs when process_request sends a plain HTTP response, without
attempting to open a WebSocket connection.
* Added the reconnect_delays argument for customizing the delays between
reconnection attempts in connect(), beyond existing WEBSOCKETS_BACKOFF_*
environment variables.
* Added wheels for Windows ARM64 and Linux i686.
Bug fixes
---------
* Restored compatibility of the websockets CLI with Windows.
* Fixed serve_forever() in the asyncio implementation so that canceling
it always closes connections gracefully.
* Fixed a bug that could delay or block the client in the threading
implementation on macOS when the opening handshake fails.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Tim Orling [Mon, 3 Aug 2026 23:26:39 +0000 (16:26 -0700)]
python3-uv-build: upgrade 0.11.32 -> 0.12.1
No changes to uv-build in git, just tags.
The uv_build package is built from the uv/crates/uv-build
directory.
git log --oneline 0.11.32..0.12.1 crates/uv-build
329541a50 (tag: 0.12.1) Bump version to 0.12.1 (#20867) 43a128899 Bump version to 0.12.0 (#20775) fece32fc5 (tag: 0.11.33) Bump version to 0.11.33 (#20764)
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
50.0.0 - 2026-07-31
SECURITY ISSUE: pkcs7_decrypt_der() and its PEM and S/MIME variants no
longer expose distinguishable errors or timing when unwrapping a
RecipientInfo’s encryptedKey, which could act as a Bleichenbacher oracle
for callers that decrypt untrusted messages. A random key is now
substituted on failure, as described in RFC 3218. Credit to X1AOxiang
for reporting the issue
Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
Everything FFDH is deprecated, including the types in
cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or
parameters with the key loading APIs. Users should migrate to a more
modern key exchange algorithm.
Added xof() class methods to SHAKE128 and SHAKE256 for constructing
algorithm instances configured for use with XOFHash.
The X.509 verification APIs are now considered stable and are subject to
our API stability policy.
Added the Cobblestone (streaming symmetric encryption) recipe, an
implementation of the Cobblestone-128 and Cobblestone-256 instantiations
of the C2SP chunked-encryption specification for streaming authenticated
encryption of large messages.
Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead
of silently ignoring them.
Added support for using Name as a field type in the ASN.1 module.
Loading a public key or an EC private key now rejects DER where the
subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number
of unused bits, instead of silently ignoring it.
Parsing a CRL entry’s InvalidityDate extension now rejects a
GeneralizedTime that carries fractional seconds or another non-DER form,
matching the strict encoding already required for every other X.509 time
field.
load_der_ocsp_request() and load_der_ocsp_response() now reject a request
or response whose version field is not v1, the only version defined by
RFC 6960, matching the version validation already performed when loading
certificates, CSRs and CRLs.
XOFHash is now supported when building against AWS-LC.
HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
building against AWS-LC.
Diffie-Hellman (Diffie-Hellman key exchange) is now supported when
building against AWS-LC.
load_der_public_key() and load_pem_public_key() now reject Diffie-Hellman
public keys whose modulus is smaller than 512 bits, matching the minimum
already enforced when loading DH private keys and when constructing
DHParameterNumbers.
Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message
representative) used by the external-mu signing and verification APIs.
The builtin HashAlgorithm classes and the classes in padding can now be
compared with ==.
CertificateBuilder now supports creating unsigned certificates (RFC 9925)
with the create_unsigned method.
The X.509 verification APIs now permit ML-DSA-44, ML-DSA-65, and ML-DSA-87
(RFC 9881) public keys and signatures by default.
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 3 Aug 2026 11:28:41 +0000 (12:28 +0100)]
ruby: upgrade 4.0.5 -> 4.0.6
Bug fixes only, upstream release notes:
- Thread.each_caller_location(1, 1) segfaults when called from a cfunc
- heap-use-after-free in rb_vm_ci_lookup under parallel Ractors
- defined? returns nil for protected methods defined in a module even when callable
- [BUG] should have cvar cache entry
- YJIT misaligns locals when there are > 256 local variables
- GC compaction breaks compare-by-identity sets
- invokesuper from define_method in Ractor can call wrong super method or crash
- Array#sum takes slow path, does not perform compensated summation of Float elements when init argument is a Float
- Float#round(n) returns a wrong result when n is big
- Float#ceil gives incorrect result
- Freeing a mutex locked by a fiber inside fiber scheduler can crash
- Crash when modifying instance variables during inspect or Marshal dump
- ASAN heap-use-after-free in rb_data_free after TypedData dfree frees dynamic rb_data_type_t
- Constant-folded /o regexp crashes with dupstring of a Regexp
- $! stays as the first exception in Ruby Box
- Split the root box into the (newer) root box and the master of copied user boxes
- Segfault caused by ar_find_entry_hint() not checking for conversion to st_table
- error_highlight raises NotImplementedError for ArgumentErrors that get wrapped
- Inconsistencies in type coercion error messages for integers
- IO::Buffer#locked leaves the buffer locked when the block raises
- parse.y regexp crash on invalid encoding
- Stack underflow for partial DCE and loops
- void value missed in parse.y
- Segfault in PRISM while Bootsnap compiles aws-sdk client_api.rb
- Unnecessary context-switching, especially bad on multi-core machines.
- Keyword-only method silently accepts a positional argument
- parse.y interpolation inside lambda literal
- SEGV in branch peephole optimization due to label/insn struct aliasing
- Ruby's default SIGINT handling ignores Thread.handle_interrupt masking.
- Enumerator::Lazy#to_enum does not accept method names as strings
- Signal.trap(:EXIT) exception only shown if at_exit also raises
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Ross Burton [Mon, 3 Aug 2026 11:28:40 +0000 (12:28 +0100)]
mesa-demos: upgrade to latest revision
- meson: Do not pass multiple dependencies in one dependency call
- eglinfo: support EXT_device_query_name and EXT_device_persistent_id
- eglinfo: move brief mode check into PrintDeviceExtensions()
- util: add a utility function for UUID printing
- eglinfo: fix doExtExplicitDevice() control flow
- eglinfo: fix querying of platforms with explicit devices
- eglinfo: add ability to show only device platforms
- eglinfo: allow platform selection for explicit devices
- vulkan: modernize vk_layer_settings.txt
- vkgears: check for errors while waiting for fences
- vkgears: specify one-time-submit
- vkgears: destroy dsl after updating ds
- vkgears: barrier to transfer-write
- eglut/wsi/wayland: remove a debug fprintf()
- vulkan/wsi/wayland: mirror the libdecor changes in eglut/wayland
- eglut/wayland: Don't leak libdecor frame
- eglut/wayland: Move libdecor context to display struct
- eglut/wayland: Don't finish display when dispatching
- eglut/wsi/wayland: Dispatch wl_display via libdecor
Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
v2.1.1
======
* Minimize internal Python API usage for interpreter and thread state
sampling where possible. Avoids breaking ABI change in
Python >= 3.15.0b4. (#269)
Signed-off-by: Tim Orling <tim.orling@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Leon Anavi [Mon, 3 Aug 2026 10:52:35 +0000 (13:52 +0300)]
python3-numpy: Upgrade 2.5.0 -> 2.5.1
Upgrade to release 2.5.1:
- The minimum supported GCC version has been updated from 9.3.0 to
10.3.0
- Bug fixes
Drop 0001-python-sysroot.patch because the vendored fork of Meson
in numpy has been upgraded to include patches from 1.12.0rc2,
including the specific sysroot fix available since since 1.10.0.
Signed-off-by: Leon Anavi <leon.anavi@konsulko.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
- Collect a config error instead of raising a raw `TypeError` when
`project.dynamic` contains a non-string (unhashable) entry with
`all_errors=True`.
Features:
- Support [PEP 808](https://peps.python.org/pep-0808/) (partially dynamic
project metadata) (METADATA 2.6).
- Add support for Python 3.15.
- Warn ([PEP 685](https://peps.python.org/pep-0685/)) when an extra name in
`project.optional-dependencies` is not a valid name. The extra is still
emitted, only a `ConfigurationWarning` is produced.
Fixes:
- Error on an unset dynamic version instead of silently writing
`Version: 0.0.0`. If `"version"` is declared in `project.dynamic` but never
assigned by the build backend, writing the metadata now raises a
`ConfigurationError` (`Field "project.version" missing`), restoring the 0.8.x
behavior that regressed in the 0.9 rewrite.
- Don't crash on a non-table `[project]` when `all_errors=True`.
- Tighten `license-files` glob checks and private-tag parsing.
- Handle braces in user data within error messages.
- Correct the `Import-Namespace` field name in the metadata mapping.
- Fix UTF-8 author and maintainer names.
Performance:
- Cache `get_type_hints` and precompile dispatch patterns.
Documentation:
- Fix a stale dynamic docstring and a broken module example.
- Add a documentation project URL.
Internal and CI:
- Refactoring: consistent dataclass decorators, sorted constant entries, and
removal of duplicate imports and dead code.
- Cover defensive branches in dispatch helpers and validators.
- Secure GitHub Actions workflows and bump pinned/downstream dependencies.
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 06:15:42 +0000 (06:15 +0000)]
libadwaita: upgrade 1.9.2 -> 1.9.3
=============
Version 1.9.3
=============
- AdwAboutDialog
- Fix a bug with deselecting text in the legal section
- AdwSidebar
- Fix item suffixes ending up after the arrow in page mode
- AdwTabOverview
- Make sure we don't round corners in adaptive preview
- AdwWindow/AdwApplicationWindow
- Fix false minimum size warnings in adaptive preview
- Translation updates
- Norwegian Bokmål
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie [Tue, 4 Aug 2026 11:54:02 +0000 (12:54 +0100)]
xmodmap: Upgrade 1.0.11 -> 1.0.12
Changes:
- xmodmap 1.0.12
- meson: include headers when checking for functions
- meson: Add option to build with meson
- handle.c: handle -Wuse-after-free warning from gcc 15
- gitlab CI: drop the ci-fairy check-mr job
- parse_keysym: handle possible NULL return from copy_to_scratch()
- Strip trailing whitespace from source files
- xmodmap.1: Some editorial changes for this man page [Debian bug #1094313]
- Improve man page text & formatting
- Accept --help & --version as aliases to -help & -version
- Use _strnicmp() instead of strncasecmp() on Windows
- Assume target platforms have strncasecmp now
- Remove "All rights reserved" from Oracle copyright notices
- gitlab CI: stop requiring Signed-off-by in commits
License-Update: Copyright line removal of "all rights reserved"
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
projects / thirdparty / openembedded / openembedded-core.git / log
