Re: [OE-core] [PATCH] cve-check: Add allowlist that is same function of whitelist.

2021-07-19 Thread ito-yui...@fujitsu.com
HI, Armin Thanks for information of wiki. I created account and add CVE_CHECK_WHITELIST in Variables. According to this message, CVE_CHECK_PN_WHITELIST is deprecate and should remove it. https://lists.openembedded.org/g/openembedded-core/message/142505 Thanks, Yuichi Ito > -Original Messa

[OE-core] [hardknott][PATCH v2] rxvt-unicode: fix CVE-2021-33477

2021-07-19 Thread kai
From: Kai Kang It fixed CVE-2021-33477 and disabled problematic code in 2 commits in rxvt-unicode upstream. Backport and rebase the latter one to fix CVE-2021-33477 for rxvt-unicode. CVE: CVE-2021-33477 Ref to: https://security-tracker.debian.org/tracker/CVE-2021-33477 Signed-off-by: Kai Kang

Re: [OE-core] how to configure an image with *full* debugging info in the libs and binaries?

2021-07-19 Thread Ross Burton
On Fri, 16 Jul 2021 at 20:10, Robert P. J. Day wrote: > colleague just asked me what it would take to generate an image > where the executables and libraries contain all the gdb-related > debugging info in the same files (that is, not broken out in the > .debug directories). > > i pointed out

[OE-core] Yocto Project Newcomer & Unassigned Bugs - Help Needed

2021-07-19 Thread Stephen Jolley
All, The triage team is starting to try and collect up and classify bugs which a newcomer to the project would be able to work on in a way which means people can find them. They're being listed on the triage page under the appropriate heading: https://wiki.yoctoproject.org/wiki/Bug_Triage#Newc

[OE-core] [PATCH] linux-yocto/5.13: update to v5.13.3

2021-07-19 Thread Bruce Ashfield
From: Bruce Ashfield Updating linux-yocto/5.13 to the latest korg -stable release that comprises the following commits: f86aa267e180 Linux 5.13.3 e472b276a0d2 f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances 258fd821f693 smackfs: restrict bytes count in sm

[OE-core] [PATCH 1/2] README.OE-Core/README.qemu: Move to markdown format

2021-07-19 Thread Richard Purdie
The READMEs are often viewed from websites so switch to markdown format which is much as readable as text and much better from html in broswers. Signed-off-by: Richard Purdie --- README.OE-Core => README.OE-Core.md | 0 README.qemu => README.qemu.md | 0 2 files changed, 0 insertions(+), 0

[OE-core] [PATCH 2/2] README: Point at README.OE-Core

2021-07-19 Thread Richard Purdie
Signed-off-by: Richard Purdie --- README.md | 1 + 1 file changed, 1 insertion(+) create mode 12 README.md diff --git a/README.md b/README.md new file mode 12 index 000..4d7e9e8b429 --- /dev/null +++ b/README.md @@ -0,0 +1 @@ +README.OE-Core.md \ No newline at end of file -- 2.

Re: [OE-core] [poky][dunfell][PATCH] buildhistory.bbclass: Enable exporting more recipe and package data

2021-07-19 Thread Steve Sakoman
There is a "master first" policy for dunfell, so this series would need to be accepted into the master branch before it can be considered for dunfell. Also, this is a new feature, so that also is an issue for including this in dunfell, where changes are typically only CVE and bug fixes. Steve On

Re: [OE-core] [dunfell][PATCH 0/1] libxml2: Update to 2.9.12

2021-07-19 Thread Steve Sakoman
On Sun, Jul 18, 2021 at 9:34 PM Martin Jansa wrote: > Does it have compatible ABI with 2.9.10 currently in dunfell? Unfortunately > https://abi-laboratory.pro/index.php?view=timeline&l=libxml2 > ends with 2.9.10 version, but previous patchfix releases were also often > incompatible, so if 2.9.12

[OE-core] [poky][dunfell][PATCH] test_buildhistory: Add test to verify that LICENSE is added

2021-07-19 Thread sana kazi
From: Sana Kazi Added test case which uses BUILDHISTORY_EXPORT_RECIPE_VARIABLES and BUILDHISTORY_EXPORT_PACKAGE_VARIABLES to add LICENSE for glibc as a sample recipe to buildhistory and the test verifies that expected license value is written in latest file. Signed-off-by: Sana Kazi --- .../re

[OE-core] [poky][dunfell][PATCH] buildhistory.bbclass: Enable exporting more recipe and package data

2021-07-19 Thread sana kazi
From: Sana Kazi Used BUILDHISTORY_EXPORT_RECIPE_VARIABLES and BUILDHISTORY_EXPORT_PACKAGE_VARIABLES to export recipe and package data to the latest file of buildhistory and sorted it alphabetically. This makes extending data in buildhistory git tree simple and avoids patches to it for users who

[OE-core] [PATCH] parted: add device mappper PACKAGECONFIG

2021-07-19 Thread Ross Burton
Instead of forcibly disabling the device mapper support, add a disabled PACKAGECONFIG. Signed-off-by: Ross Burton --- meta/recipes-extended/parted/parted_3.4.bb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta/recipes-extended/parted/parted_3.4.bb b/meta/recipes-exte

[OE-core] [PATCH] avahi: fix CVE-2021-36217, crash on pinging '.local'

2021-07-19 Thread Ross Burton
Signed-off-by: Ross Burton --- meta/recipes-connectivity/avahi/avahi_0.8.bb | 1 + .../avahi/files/local-ping.patch | 152 ++ 2 files changed, 153 insertions(+) create mode 100644 meta/recipes-connectivity/avahi/files/local-ping.patch diff --git a/meta/recipes-co

Re: [OE-core] [yocto-security] OE-core CVE metrics for master on Sun 18 Jul 2021 04:00:01 AM HST

2021-07-19 Thread Ross Burton
On Sun, 18 Jul 2021 at 15:03, Steve Sakoman wrote: > New this week: 1 CVEs > CVE-2021-36217: avahi > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-36217 * Patch incoming for this. Ross -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#1

[OE-core] [PATCH] btrfs-tools: upgrade 5.12.1 -> 5.13

2021-07-19 Thread wangmy
Add patch to fix bug for undeclared macro on musl. btrfs-progs-5.13 (2021-07-13) * restore: remove loop checks for extent count and directory scan * inspect dump-tree: new options to print node (--csum-headers) and data checksums (--csum-items) * fi usage: * print s

Re: [OE-core] [PATCH] image_types_wic: pass --debug for verbose logs

2021-07-19 Thread Alexandre Belloni
Hello Ross, On 15/07/2021 15:32:57+0100, Ross Burton wrote: > The output goes to a log file, so having more information is useful for > debugging. > This took me a while to bisect and you are going to love that, this is causing oe-selftest failures: ERROR: Task (/home/pokybuild/yocto-worker/o

Re: [OE-core] [dunfell][PATCH 0/1] libxml2: Update to 2.9.12

2021-07-19 Thread Martin Jansa
On Mon, Jul 19, 2021 at 2:15 AM Tim Orling wrote: > Cherry-pick/back port commit from master. > > Since 2.9.10, upstream libxml2 has enabled fuzz testing and MANY > commits have been added with fixes and security patches. > > Of the 239 commits since 2.9.10, 94 have "Fix" in the shortlog. > A qui