> -Original Message-
> From: openembedded-core-boun...@lists.openembedded.org
> [mailto:openembedded-core-boun...@lists.openembedded.org] On Behalf Of
> Paul Eggleton
> Sent: den 3 november 2017 04:16
> To: openembedded-core@lists.openembedded.org
> Subject: [OE-core] [PATCH 3/3] scripts/se
On 10/31/2017 02:26 AM, André Draszik wrote:
> Hi Armin,
>
> On Sat, 2017-10-28 at 08:42 -0700, Armin Kuster wrote:
>> Thomas PERROT (1):
>> Avoid a circular dependency between do_concat_dtb and
>> do_assemble_fitimage
> This is not in master, and I still think this is wrong.
ah, ok. patch
Just an update on this for Philippe and any interested parties.
I started down the line of grabbing the patch and was indeed able to get the
tars to add into the cache. I was also able to get the system to build offline
with some manual tweaking.
The main issue I am running into now is that we n
On Fri, Nov 3, 2017 at 1:23 PM Matt Madison wrote:
> Update to the go1.9.2 minor release, which includes
> fixes to the compiler and runtime.
>
This is good
>
> Signed-off-by: Matt Madison
> ---
> meta/recipes-devtools/go/go-1.9.inc | 8 ++--
> 1 file changed, 6 insertions(+), 2 deletions
The libevdev configure script contains an unconditional check for
libcheck. If libcheck is found, libevdev unit tests will be built.
Without a dependency, the presence of libcheck in sysroot is non
deterministic (in morty and earlier) and builds can fail if libcheck
is available during do_configur
On Fri, Nov 3, 2017 at 6:23 PM, Matt Madison wrote:
> Update to the go1.9.2 minor release, which includes
> fixes to the compiler and runtime.
>
> Signed-off-by: Matt Madison
Acked-by: Otavio Salvador
--
Otavio Salvador O.S. Systems
http://www.ossystems.com.br
Update to the go1.9.2 minor release, which includes
fixes to the compiler and runtime.
Signed-off-by: Matt Madison
---
meta/recipes-devtools/go/go-1.9.inc | 8 ++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/meta/recipes-devtools/go/go-1.9.inc
b/meta/recipes-devtools/go/g
On Fri, 03 Nov 2017 20:03:06 -
Patchwork wrote:
> == Series Details ==
>
> Series: core package updates
> Revision: 1
> URL : https://patchwork.openembedded.org/series/9623/
> State : failure
>
> == Summary ==
>
>
> Thank you for submitting this patch series to OpenEmbedded Core. This i
== Series Details ==
Series: core package updates
Revision: 1
URL : https://patchwork.openembedded.org/series/9623/
State : failure
== Summary ==
Thank you for submitting this patch series to OpenEmbedded Core. This is
an automated response. Several tests have been executed on the proposed
se
This is a bug fix release on the
current stable branch. Note that, I've also switched the release
cadence to bi-monthly as less and less bug fixes/updates accumulate
each month on this branch.
** API and ABI modifications:
No changes since last version.
Signed-off-by: Armin Kuster
---
meta/reci
Security Fixes
* An error in TSIG handling could permit unauthorized zone transfers
or zone updates. These flaws are disclosed in CVE-2017-3142 and
CVE-2017-3143. [RT #45383]
* The BIND installer on Windows used an unquoted service path, which
can enable privilege es
LICENSE files changed:
Amend licence to relax its conditions for chains of binary distributions.
removed included patches
includes CVE-2017-8399
Signed-off-by: Armin Kuster
---
.../libpcre/libpcre2/libpcre2-CVE-2017-7186.patch | 96 --
.../libpcre/libpcre2/libpcre2-CVE-201
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.33_release_notes
* TLS compression is no longer supported. API calls that attempt to enable
compression are accepted without failure. However, TLS compression will remain
disabled.
* This version of NSS uses a formally verified
A collection of minor fixes since 2.0.1, including CVEs 2017-13720
and 2017-13722.
Signed-off-by: Armin Kuster
---
.../xorg-lib/{libxfont2_2.0.1.bb => libxfont2_2.0.2.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-graphics/xorg-lib/{libxfont2_2.0
LICENSE changed do to name being added
removed patches included in some form
Signed-off-by: Armin Kuster
---
.../openssh/add-test-support-for-busybox.patch | 64 ---
...h-7.1p1-conditional-compile-des-in-cipher.patch | 119 -
...h-7.1p1-conditional-compile-des-i
Signed-off-by: Armin Kuster
---
.../{xf86-input-libinput_0.25.1.bb => xf86-input-libinput_0.26.0.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-graphics/xorg-driver/{xf86-input-libinput_0.25.1.bb =>
xf86-input-libinput_0.26.0.bb} (63%)
diff --git a/meta/reci
Check for end of string in PatternMatch (CVE-2017-13720)
pcfGetProperties: Check string boundaries (CVE-2017-13722)
https://lists.x.org/archives/xorg-announce/2017-October/002816.html
Signed-off-by: Armin Kuster
---
.../xorg-lib/{libxfont_1.5.2.bb => libxfont_1.5.3.bb} | 4 ++--
Remove patches that are included in 1.19.4
[ANNOUNCE] xorg-server 1.19.4
https://lists.x.org/archives/xorg-devel/2017-October/054839.html
xkb: Handle xkb formated string output safely (CVE-2017-13723)
Xext/shm: Validate shmseg resource id (CVE-2017-13721)
[ANNOUNCE] xorg-server 1.19.5
https://li
Signed-off-by: Armin Kuster
---
meta/recipes-support/nspr/{nspr_4.16.bb => nspr_4.17.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-support/nspr/{nspr_4.16.bb => nspr_4.17.bb} (96%)
diff --git a/meta/recipes-support/nspr/nspr_4.16.bb
b/meta/recipes-support/ns
Signed-off-by: Armin Kuster
---
.../xorg-lib/{libxkbcommon_0.7.1.bb => libxkbcommon_0.7.2.bb} | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
rename meta/recipes-graphics/xorg-lib/{libxkbcommon_0.7.1.bb =>
libxkbcommon_0.7.2.bb} (83%)
diff --git a/meta/recipes-graphics/xorg-l
Signed-off-by: Armin Kuster
---
.../xorg-lib/{xkeyboard-config_2.21.bb => xkeyboard-config_2.22.bb} | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
rename meta/recipes-graphics/xorg-lib/{xkeyboard-config_2.21.bb =>
xkeyboard-config_2.22.bb} (87%)
diff --git a/meta/recipes-graphics/
https://lists.x.org/archives/xorg-announce/2017-October/002812.html
integer overflow in XResQueryClients() [CVE-2013-1988 1/2]
integer overflow in XResQueryClientResources() [CVE-2013-1988 2/2]
Signed-off-by: Armin Kuster
---
meta/recipes-graphics/xorg-lib/{libxres_1.0.7.bb => libxres_1.2.0.bb}
LICENSE changed do to rewording
https://github.com/eggert/tz/commit/7097a652778d35acf747d14f8bf7b3ced479bbc0#diff-9879d6db96fd29134fc802214163b95a
Briefly:
Northern Cyprus switches from +03 to +02/+03 on 2017-10-29.
Fiji ends DST 2018-01-14, not 2018-01-21.
Namibia switches from +01/+02 to
please consider these update for master-next
The following changes since commit 3b413a80578caacd9a7f405f3c51a3921d78a60d:
README.qemu: qemuppc64 is not supported (2017-10-16 23:54:27 +0100)
are available in the git repository at:
git://git.openembedded.org/openembedded-core-contrib akuster/
LICENSE changes do to rewording
https://github.com/eggert/tz/commit/7097a652778d35acf747d14f8bf7b3ced479bbc0#diff-9879d6db96fd29134fc802214163b95a
Backported to fixes from upstream too.
Changes to code
zic and the reference runtime now reject multiple leap seconds
within 28 days of each
On Fri, Nov 3, 2017 at 2:03 AM, Alexander Kanavin
wrote:
> On 11/02/2017 10:29 PM, Andre McCurdy wrote:
Update the master to 1.19.2 instead please.
>>
>> Patching 1.19.1 does have the advantage of creating a commit which can
>> easily be cherry-picked into rocko (and pyro, which also use
On 11/3/17 5:14 AM, Alexander Kanavin wrote:
> On 10/18/2017 03:14 PM, Alexander Kanavin wrote:
>> Previously oe-core had a development snapshot of rpm, it's better to update
>> to something more stable.
>
> Unfortunately, this also breaks grub and grub-efi:
>
> x86_64-poky-linux-musl-objcopy:
>
Bump libxfont version to 1.5.3 and libxfont2 version to 2.0.2 in order to
eliminate CVE-2017-13720 and CVE-2017-13722 vulnerabilities.
In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2
and 2.x before 2.0.2, an attacker with access to an X connection can cause
a buffer ov
On 2017-11-01 01:07 PM, Alexander Kanavin wrote:
On 11/01/2017 06:28 PM, Catalin Enache wrote:
In the PatternMatch function in fontfile/fontdir.c in libXfont through
1.5.2
and 2.x before 2.0.2, an attacker with access to an X connection can
cause
a buffer over-read during pattern matching of fo
Feeding the output of /dev/urandom into /dev/random is pretty much insane
and not something we should encourage.
I can't really imagine a scenario where this would be a sensible idea since
/dev/urandom if effectively derived from /dev/random.
This changes the tool to default to /dev/hwrng which m
On Fri, Nov 3, 2017 at 3:14 AM, Alexander Kanavin
wrote:
> On 10/18/2017 03:14 PM, Alexander Kanavin wrote:
>>
>> Previously oe-core had a development snapshot of rpm, it's better to
>> update
>> to something more stable.
>
>
> Unfortunately, this also breaks grub and grub-efi:
>
> x86_64-poky-lin
On Fri, Nov 3, 2017 at 1:34 PM, Alexander Kanavin
wrote:
> On 11/03/2017 05:08 PM, akuster808 wrote:
>
>> SRCPV causes package versioning havoc. You can not tell what version
>> 1.1.8+git(hash) or 1.1.8+git(hash) is the latest on a system. Can your
>> package manage figure that out?
>
> I thought
On 03/11/17 15:18, akuster808 wrote:
Joshua,
On 11/03/2017 02:11 AM, Joshua Lock wrote:
On the Yocto Project Autobuilder we occasionally see qemu fail to start,
most frequently on Fedora 25, because kvm fails to allocate memory. See:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=12058
On 11/03/2017 05:08 PM, akuster808 wrote:
SRCPV causes package versioning havoc. You can not tell what version
1.1.8+git(hash) or 1.1.8+git(hash) is the latest on a system. Can your
package manage figure that out?
I thought the entire point of SRCPV is to provide something that is
guaranteed
Joshua,
On 11/03/2017 02:11 AM, Joshua Lock wrote:
> On the Yocto Project Autobuilder we occasionally see qemu fail to start,
> most frequently on Fedora 25, because kvm fails to allocate memory. See:
>
> https://bugzilla.yoctoproject.org/show_bug.cgi?id=12058
>
> This patch introduces a fallback
Andrea,
On 11/02/2017 01:46 AM, Andrea Adami wrote:
> Hello,
>
> the gcc7 shipped with rocko produces unbootable kernels on armv5e [1].
> Bug was fixed recently, apparently in revision 253892 [2]
If you have a test case ie qemu settings, I can open a bug and handle
it that way too
thanks for fi
On 11/02/2017 05:21 AM, Otavio Salvador wrote:
> On Thu, Nov 2, 2017 at 10:19 AM, Alexander Kanavin
> wrote:
>> On 11/02/2017 07:39 AM, Khem Raj wrote:
>>
>>> Changes since v2: Move to 1.1.18 release
>>> -PV = "1.1.16+git${SRCPV}"
>>> +PV = "1.1.18+git${SRCPV}"
>>
>> Can you drop this, and simpl
Npm v4/v6 have a patch to allow the --no-registry to work. It was taken out in
the transition to Node 8 since the cache system is completely different.
Unfortunately this doesn't work for nodev8 / npmv5 so the offline build on
master/rocko is completely broken.
I am trying to get something worki
On Fri, Oct 20, 2017 at 09:15:05AM -0400, Tom Rini wrote:
> On Tue, Oct 10, 2017 at 05:01:49PM -0400, Tom Rini wrote:
> > On Thu, Sep 21, 2017 at 01:46:16PM -0400, Tom Rini wrote:
> > > When we have been told to use the UUID we should also update the fstab
> > > to make use of PARTUUID instead of h
WPA2 is vulnerable to replay attacks which result in unauthenticated users
having access to the network.
* CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake
* CVE-2017-13078: reinstallation of the group key in the Four-way handshake
* CVE-2017-13079: reinstallation of
== Series Details ==
Series: wpa_supplicant: fix WPA2 key replay security bug (rev8)
Revision: 8
URL : https://patchwork.openembedded.org/series/9359/
State : failure
== Summary ==
Thank you for submitting this patch series to OpenEmbedded Core. This is
an automated response. Several tests ha
WPA2 is vulnerable to replay attacks which result in unauthenticated users
having access to the network.
* CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake
* CVE-2017-13078: reinstallation of the group key in the Four-way handshake
* CVE-2017-13079: reinstallation of
Option --no-registry seems deprecated or even non supported for ages,
while --offline fixed the problem on install task.
Issue can be reproduced using:
devtool add "npm://registry.npmjs.org;name=epoll;version=latest"
bitbake epoll
| DEBUG: Executing shell function do_install
(...)
| np
On 10/18/2017 03:14 PM, Alexander Kanavin wrote:
Previously oe-core had a development snapshot of rpm, it's better to update
to something more stable.
Unfortunately, this also breaks grub and grub-efi:
x86_64-poky-linux-musl-objcopy:
/home/ak/development/poky/build-64/tmp/work/core2-64-poky-l
On the Yocto Project Autobuilder we occasionally see qemu fail to start,
most frequently on Fedora 25, because kvm fails to allocate memory. See:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=12058
This patch introduces a fallback path where if the inital qemu command fails
and kvm is enabled
On 11/02/2017 10:29 PM, Andre McCurdy wrote:
Update the master to 1.19.2 instead please.
Patching 1.19.1 does have the advantage of creating a commit which can
easily be cherry-picked into rocko (and pyro, which also uses wget
1.19.1).
Yes, but this is coincidental. If the versions wouldn't e
WPA2 is vulnerable to replay attacks which result in unauthenticated users
having access to the network.
* CVE-2017-13077: reinstallation of the pairwise key in the Four-way handshake
* CVE-2017-13078: reinstallation of the group key in the Four-way handshake
* CVE-2017-13079: reinstallation of
The following changes since commit 514a808f21c37b6ad704ce397bb2740ecc9a93bc:
ref-manual: Updates to "Image Generation" section. (2017-10-30 15:55:08 +)
are available in the git repository at:
https://github.com/DengkeDu/openembedded-core.git dengke/expat-2.2.5
https://github.com//tree/
Signed-off-by: Dengke Du
---
meta/recipes-core/expat/expat/libtool-tag.patch | 34 +
meta/recipes-core/expat/expat_2.2.3.bb | 4 ---
meta/recipes-core/expat/expat_2.2.5.bb | 4 +++
3 files changed, 27 insertions(+), 15 deletions(-)
delete mode 100644 m
- remove backported patches (CVE-* and fix-*)
- adapt changes from 2.9.5+ version into ptest patch
Signed-off-by: Andrej Valek
---
.../libxml/libxml2/libxml-m4-use-pkgconfig.patch | 2 +-
.../libxml/libxml2/libxml2-CVE-2016-4658.patch | 269 --
.../libxml/libxml2/libxml2-CVE-2016
50 matches
Mail list logo
