On Fri Jul 10, 2026 at 9:59 AM CEST, Benjamin Robin wrote: > On Thursday, July 9, 2026 at 11:05 PM, Yoann Congal wrote: >> On Mon Jul 6, 2026 at 1:00 PM CEST, Benjamin Robin via >> lists.openembedded.org wrote: >> > When using the "tarfile" module with a file opened in "streaming mode" >> > (mode="r|") the tarfile module did not properly handle EOF, making archive >> > parsing take exponentially longer. >> > >> > Signed-off-by: Benjamin Robin (Schneider Electric) >> > <[email protected]> >> > --- >> > .../python/python3/CVE-2026-11972.patch | 59 >> > ++++++++++++++++++++++ >> > meta/recipes-devtools/python/python3_3.14.6.bb | 1 + >> > 2 files changed, 60 insertions(+) >> > >> > diff --git a/meta/recipes-devtools/python/python3/CVE-2026-11972.patch >> > b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch >> > new file mode 100644 >> > index 000000000000..7dc9c6697112 >> > --- /dev/null >> > +++ b/meta/recipes-devtools/python/python3/CVE-2026-11972.patch >> > @@ -0,0 +1,59 @@ >> > +From 2d256d4bfd654bdcaf2d96733799be73b8ff8f69 Mon Sep 17 00:00:00 2001 >> > +From: Petr Viktorin <[email protected]> >> > +Date: Tue, 23 Jun 2026 15:13:30 +0200 >> > +Subject: [PATCH 2/2] gh-151981: Make tarfile._Stream.seek break at EOF >> > + (GH-151982) >> > + >> > +CVE: CVE-2026-11972 >> > +Upstream-Status: Backport >> > [https://github.com/python/cpython/commit/f50bf13566189c8d0ce5a814f33eff3d89951896] >> >> Hello, >> >> Upstream patch had a "Co-authored-by: Stan Ulbrych <[email protected]>" >> that I readded on my branch. Can you send a patch to master to re-add it >> there >> too? > > I sent a patch to fix that, same for "glib-2.0: fix CVE-2026-58016". > I am sorry, this was done due to a lack of knowledge regarding how to handle > it. > To summarize, do I just need to include these lines at the end of the commit > message in the patch, without altering anything else? > - CVE: > - Upstream-Status: > - My Signed-off-by > > In Yocto, what is the rule when backporting a commit which is in master, for > example to Wrynose, regarding the Signed-off-by? I just need to add mine > without touching anything else? Is there any difference if I am the author > of the commit in master or not? > > Thanks
There is a nice subtility here: * If your commit is a trivial cherry-pick (ie not change master->wrynose), then I may re-do the cherry-pick myself (per [0]) and erase your signed-off-by (I try to preserve it but I might miss it) * If this is a more complex backport (with changes related to the backporting operation, then, I'll definititely keep your cherry-pick as authorship info about the backporting effort. In the special case of you being the author of the backported master commit, then I *think* one signed-off-by is enough unless there are changes during backport. Then you will have: Signed-off-by: You Signed-off-by: (master maintainers) If needed: backport info: (cherry-pick from ...), details, ... Signed-off-by: You # for the above work Signed-off-by: Stable maintainer # That I would add [0]: https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS#Normal_process Regards, -- Yoann Congal Smile ECS
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#240616): https://lists.openembedded.org/g/openembedded-core/message/240616 Mute This Topic: https://lists.openembedded.org/mt/120137537/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
