Re: [OE-core] [PATCH 1/3] busybox: Backport a patch to build with CONFIG_SHA1_HWACCEL on non-x86

2024-11-03 Thread Andrej Valek
Hello Peter, I was also thinking about picking this two patches, but I didn't have a time for verification. Are you sure, that this https://lists.busybox.net/pipermail/busybox/2023-January/090078.html has been fixed, right? Or did you verify it? Regards, Andrej On 02.11.2024 21:39, Peter Kj

Re: [OE-core] [PATCH v2 2/9] busybox: disable defconfig options from simpler fragments

2024-10-29 Thread Andrej Valek
Hello Enrico, On 28.10.2024 11:39, Enrico Jörns wrote: Hej Andrej, Am Montag, dem 28.10.2024 um 10:06 +0100 schrieb Andrej Valek:  Hello Enrico,  I tried to follow (and applied) your patch, but it looks little bit inconsistent to me. In the first round you enabled SHAx_HWACCEL, which is

Re: [OE-core] [PATCH v2 2/9] busybox: disable defconfig options from simpler fragments

2024-10-28 Thread Andrej Valek
Hello Enrico, I tried to follow (and applied) your patch, but it looks little bit inconsistent to me. In the first round you enabled SHAx_HWACCEL, which is broken on some architectures. That's the reason, why is disabled by default. Ok, so first apply looks like this:  # CONFIG_FEATURE_BUFFE

Re: [OE-core] [yocto] [PATCH 0/9] busybox: cleanup and fix config fragments

2024-10-25 Thread Andrej Valek
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#206356): https://lists.openembedded.org/g/openembedded-core/message/206356 Mute This Topic: https://lists.openembedded.org/mt/109189431/21656 Group Owner: openembedded-core+ow...@lists.openembedded.or

Re: [OE-core] [yocto] [PATCH 0/9] busybox: cleanup and fix config fragments

2024-10-25 Thread Andrej Valek
Hi Enrico, Could you please guide me to the right patch? I wasn't able to find it ;). BR, Andrej On 24.10.2024 15:04, Enrico Jörns wrote: Am Montag, dem 07.10.2024 um 14:09 +0200 schrieb Enrico Jörns: [TO += Andrej Valek ] Most of the busybox config fragments are useless sinc

Re: [OE-core][PATCH v3] busybox: 1.36.1 -> 1.37.0

2024-10-23 Thread Andrej Valek
Ok, god it..., it was a conflicting getfattr utility :) V4 should fix it: https://lists.openembedded.org/g/openembedded-core/message/206257, hopefully... BR, Andrej On 23.10.2024 16:52, Richard Purdie wrote: On Wed, 2024-10-23 at 11:14 +0200, Andrej Valek wrote: Sorry for pinging you

[OE-core][PATCH v4] busybox: 1.36.1 -> 1.37.0

2024-10-23 Thread Andrej Valek
mailing list - fix problem with syslogd when nothing was logged - fix problem with start-stop-daemon tests - remove and refresh already merged patches Signed-off-by: Andrej Valek --- ...ab_1.36.1.bb => busybox-inittab_1.37.0.bb} | 0 ...01-awk-fix-precedence-of-relative-to.patch |

Re: [OE-core][PATCH v3] busybox: 1.36.1 -> 1.37.0

2024-10-23 Thread Andrej Valek
_64-poky-linux" MACHINE  = "qemux86-64" DISTRO   = "poky" DISTRO_VERSION   = "5.1" TUNE_FEATURES    = "m64 core2" So I will test it with "poky-altcfg" and "core-image-sato-sdk" and hopefully hit th

Re: [OE-core][PATCH v3] busybox: 1.36.1 -> 1.37.0

2024-10-23 Thread Andrej Valek
Sorry for pinging you Richard, Could you please check it again? I wanted to be sure that there are no leftovers. BR, Andrej On 19.10.2024 18:02, Andrej Valek wrote: - update to next stable version 1.37.0 - refresh defconfig - disable new applets (ip_link_can) - enable new applets

Re: Patchtest results for [OE-core][PATCH v3] busybox: 1.36.1 -> 1.37.0

2024-10-19 Thread Andrej Valek
This is an false-positive error, while I've renamed the file and removed :). On 19.10.2024 18:19, patcht...@automation.yoctoproject.org wrote: Thank you for your submission. Patchtest identified one or more issues with the patch. Please see the log below for more information: --- Testing patch

[OE-core][PATCH v3] busybox: 1.36.1 -> 1.37.0

2024-10-19 Thread Andrej Valek
mailing list - fix problem with syslogd when nothing was logged - fix problem with start-stop-daemon tests - remove and refresh already merged patches Signed-off-by: Andrej Valek --- ...ab_1.36.1.bb => busybox-inittab_1.37.0.bb} | 0 ...01-awk-fix-precedence-of-relative-to.patch |

Re: [OE-core][PATCH] busybox: 1.36.1 -> 1.37.0

2024-10-18 Thread Andrej Valek
Hello Richard, Could you please check if https://lists.openembedded.org/g/openembedded-core/message/205956 fixed all issues? In case of not, let me know and will try to fix them. Regards, Andrej On 15.10.2024 14:20, Andrej Valek wrote: Hi all, Busysbox upgrade status: Ok, there were

[OE-core][PATCH v2] busybox: 1.36.1 -> 1.37.0

2024-10-16 Thread Andrej Valek
mailing list - fix problem with syslogd when nothing was logged - fix problem with start-stop-daemon tests - remove and refresh already merged patches Signed-off-by: Andrej Valek --- ...ab_1.36.1.bb => busybox-inittab_1.37.0.bb} | 0 ...01-awk-fix-precedence-of-relative-to.patch |

Re: [OE-core][PATCH] busybox: 1.36.1 -> 1.37.0

2024-10-15 Thread Andrej Valek
ysklogd?id=02378ce20c6d2df062357b6d60fc440609d203be so I have to dig into the problem and try to fix it. Regards, Andrej On 11.10.2024 14:33, Richard Purdie wrote: On Fri, 2024-10-11 at 11:48 +0200, Andrej Valek via lists.openembedded.org wrote: - update to next stable version 1.37.0  - refresh defconfig    - d

[OE-core][PATCH] busybox: 1.36.1 -> 1.37.0

2024-10-11 Thread Andrej Valek
- update to next stable version 1.37.0 - refresh defconfig - disable new applets (ip_link_can) - enable new applets (time64, find_exec_ok, getfattr, udhcpd_bootp) - remove and refresh already merged patches Signed-off-by: Andrej Valek --- ...ab_1.36.1.bb => busybox-inittab_1.37.0

Re: [OE-core] Expired certificate https://git.openembedded.org/

2024-08-19 Thread Andrej Valek
Now is even worst, server is completely down. Andy On 05.08.2024 15:15, Peter Marko via lists.openembedded.org wrote: In case no one noticed yet, the certificate expired an hour ago, so the repositories can’t be viewed in a browser… Peter -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all

Re: [OE-core] [oe]printhello

2024-08-13 Thread Andrej Valek
executable. Alex On Mon, 12 Aug 2024 at 10:22, Andrej Valek wrote: Hello Alex, Here is some more information... /home/projects/Yocto/poky/build/tmp/work/all-poky-linux/printhello/1/temp$ tree . ├── cve.json ├── depsig.do_create_runtime_spdx -> depsig.do_create_runti

Re: [OE-core] [oe]printhello

2024-08-12 Thread Andrej Valek
nges: do_configure() {   bbwarn ""   bbwarn "*  *"   bbwarn "*  Hello, World!   *"   bbwarn "*  *"   bbwarn "" } but I was expecting something like point 12. from https://docs.yoct

[OE-core] [oe]printhello

2024-08-08 Thread Andrej Valek
Dear community! I know this could be a funny question, but I wanted to use the "printhello" recipe as a basic example. But looks like, that is little bit "out-of-date". I know, that I can crate a custom recipe, but I wanted to use something "standard", so I took poky/bitbake/doc/bitbake-use

Re: [OE-core] [RFT][PATCH] glibc: Upgrade to 2.39

2024-01-22 Thread Andrej Valek
Hello Raj, Is this one https://lists.openembedded.org/g/openembedded-core/message/194128 ok? Regards, Andy On 19.01.2024 15:47, Khem Raj wrote: On Thu, Jan 18, 2024 at 11:22 PM Andrej Valek wrote: Hello Raj, I will try to take a look on this today. Is the patch the same as here https

[OE-core][PATCH] glibc: Refresh CVE statuses

2024-01-22 Thread Andrej Valek
- drop irrelevant CVEs Signed-off-by: Valek Andrej --- meta/recipes-core/glibc/glibc-version.inc | 5 - meta/recipes-core/glibc/glibc_2.39.bb | 2 -- 2 files changed, 7 deletions(-) diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index

[OE-core][PATCH] glibc: Refresh CVE statuses

2024-01-22 Thread Andrej Valek
- drop irrelevant CVEs Signed-off-by: Valek Andrej --- meta/recipes-core/glibc/glibc-version.inc | 5 - meta/recipes-core/glibc/glibc_2.39.bb | 2 -- 2 files changed, 7 deletions(-) diff --git a/meta/recipes-core/glibc/glibc-version.inc b/meta/recipes-core/glibc/glibc-version.inc index

Re: [OE-core] [RFT][PATCH] glibc: Upgrade to 2.39

2024-01-18 Thread Andrej Valek
n 16, 2024 at 11:10 PM Andrej Valek wrote: Hello Raj, Don't forget to change the glibc-version.inc too and try to make a optimization/cleaning like I proposed here: https://lists.openembedded.org/g/openembedded-core/message/193572 ;). yeah CVEs list will need cleaning anyway as it will be ve

Re: [OE-core] [RFT][PATCH] glibc: Upgrade to 2.39

2024-01-16 Thread Andrej Valek
Hello Raj, Don't forget to change the glibc-version.inc too and try to make a optimization/cleaning like I proposed here: https://lists.openembedded.org/g/openembedded-core/message/193572 ;). Regards, Andy On 16.01.2024 20:53, Khem Raj wrote: Upgrade localdef to get glibc 2.39 build fixes D

Re: [OE-core] [PATCH] glibc: Set status for CVE-2023-5156 & CVE-2023-0687

2024-01-11 Thread Andrej Valek
Hi Simone, I would like make a small improvements here ;). Once you're touching this file, make it little bit more optimized. Something like this: CVE_STATUS_GROUPS += "CVE_STATUS_GLIBC" CVE_STATUS_GLIBC = "CVE-2023-4527 CVE-2023-4911 CVE-2023-4806"... CVE_STATUS_GLIBC[status] = "fixed-version

Re: [OE-core] [PATCH v2] cve-check: Classify patched CVEs into 3 statuses

2023-10-25 Thread Andrej Valek
er had the vulnerability. Those are also currently 'Patched' in cve-check. This work is in sync with what VEX is doing, is it the use-case Matsanaga-Shinji? Regards, Marta On Wed, Oct 25, 2023 at 8:44 AM Andrej Valek wrote: Hi all, Do we really need a new "not_affected" stat

Re: [OE-core] [PATCH v2] cve-check: Classify patched CVEs into 3 statuses

2023-10-24 Thread Andrej Valek
Hi all, Do we really need a new "not_affected" state? I guess the ignore state is exactly designed for those purposes. Regards, Andrej On 25.10.2023 07:13, Matsunaga-Shinji wrote: CVEs that are currently considered "Patched" are classified into the following 3 statuses: 1. "Patched" -

[OE-core][PATCH] maintainers.inc: Modify email address

2023-07-29 Thread Andrej Valek via lists.openembedded.org
From: Andrej Valek andrej.va...@siemens.com -> andre...@skyrain.eu Signed-off-by: Andrej Valek --- meta/conf/distro/include/maintainers.inc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/meta/conf/distro/include/maintainers.inc b/meta/conf/distro/include/maintainers.

[OE-core][PATCH] cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS

2023-07-20 Thread Andrej Valek via lists.openembedded.org
- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek Reviewed-by: Peter Marko --- .../distro/include/cve-extra-exclusions.inc | 149 meta/recipes-bsp/grub/grub2.inc

Re: [OE-core][PATCH v9 0/3] CVE-check handling

2023-07-19 Thread Andrej Valek via lists.openembedded.org
Even better, So I will make one more rebase, just for "[OE-core][PATCH v9 3/3] cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS" Regards, Andrej On Wed, 2023-07-19 at 11:16 +, Ross Burton wrote: > On 19 Jul 2023, at 11:54, Richard Purdie > wrote: > > > > On Wed, 2023-07-19 at 10:26 +,

Re: [OE-core][PATCH v9 0/3] CVE-check handling

2023-07-19 Thread Andrej Valek via lists.openembedded.org
Hello, I would like to ask, what's the status here? Regards, Andrej On Fri, 2023-06-23 at 13:14 +0200, Andrej Valek wrote: > After discussion in all parallel threads we proposed following variant which > covers both expressed requirements to have very small number of different cve

Re: [OE-core][PATCH v8 1/3] cve-check: add option to add additional patched CVEs

2023-06-23 Thread Andrej Valek via lists.openembedded.org
On Fri, 2023-06-23 at 10:02 +, Ross Burton wrote: > On 22 Jun 2023, at 13:00, Andrej Valek via lists.openembedded.org > wrote: > > - Replace CVE_CHECK_IGNORE with CVE_STATUS to be more flexible. > > The CVE_STATUS should contain an information about status wich > &g

[OE-core][PATCH v9 2/3] oeqa/selftest/cve_check: rework test to new cve status handling

2023-06-23 Thread Andrej Valek via lists.openembedded.org
From: Andrej Valek - After introducing the CVE_STATUS and CVE_CHECK_STATUSMAP flag variables, CVEs could contain a more information for assigned statuses. - Add an example conversion in logrotate recipe. Signed-off-by: Andrej Valek --- meta/lib/oeqa/selftest/cases/cve_check.py | 26

[OE-core][PATCH v9 0/3] CVE-check handling

2023-06-23 Thread Andrej Valek via lists.openembedded.org
After discussion in all parallel threads we proposed following variant which covers both expressed requirements to have very small number of different cve statuses and also very large number of them at the same time. This is a compromise version which maybe is not ideal but deals with conflicting r

[OE-core][PATCH v9 1/3] cve-check: add option to add additional patched CVEs

2023-06-23 Thread Andrej Valek via lists.openembedded.org
From: Andrej Valek - Replace CVE_CHECK_IGNORE with CVE_STATUS to be more flexible. The CVE_STATUS should contain an information about status wich is decoded in 3 items: - generic status: "Ignored", "Patched" or "Unpatched" - more detailed status enum - descriptio

Re: [OE-core][PATCH v7 0/3] CVE-check handling

2023-06-22 Thread Andrej Valek via lists.openembedded.org
send a link where is not required? Maybe here > https://autobuilder.yoctoproject.org/typhoon/#/ ? > > Regards, > Andrej > > On Thu, 2023-06-22 at 15:55 +0200, Luca Ceresoli wrote: > > Hello Andrej, > > > > On Thu, 22 Jun 2023 13:50:32 + > > "Andre

Re: [OE-core][PATCH v7 0/3] CVE-check handling

2023-06-22 Thread Andrej Valek via lists.openembedded.org
t; On Thu, 22 Jun 2023 13:50:32 + > "Andrej Valek via lists.openembedded.org" > wrote: > > > Hello Luca, > > > > How can I reproduce it? I've executed "bitbake qemu -c create_spdx" but it > > didn't print any warning. Should

Re: [OE-core][PATCH v7 0/3] CVE-check handling

2023-06-22 Thread Andrej Valek via lists.openembedded.org
Hello Luca, How can I reproduce it? I've executed "bitbake qemu -c create_spdx" but it didn't print any warning. Should I build an image? Regards, Andrej On Thu, 2023-06-22 at 14:42 +0200, Luca Ceresoli wrote: > Hello Andrej, > > On Thu, 22 Jun 2023 08:59

[OE-core][PATCH v8 1/3] cve-check: add option to add additional patched CVEs

2023-06-22 Thread Andrej Valek via lists.openembedded.org
From: Andrej Valek - Replace CVE_CHECK_IGNORE with CVE_STATUS to be more flexible. The CVE_STATUS should contain an information about status wich is decoded in 3 items: - generic status: "Ignored", "Patched" or "Unpatched" - more detailed status enum - descriptio

[OE-core][PATCH v8 2/3] oeqa/selftest/cve_check: rework test to new cve status handling

2023-06-22 Thread Andrej Valek via lists.openembedded.org
From: Andrej Valek - After introducing the CVE_STATUS and CVE_CHECK_STATUSMAP flag variables, CVEs could contain a more information for assigned statuses. - Add an example conversion in logrotate recipe. Signed-off-by: Andrej Valek --- meta/lib/oeqa/selftest/cases/cve_check.py | 26

[OE-core][PATCH v8 0/3] CVE-check handling

2023-06-22 Thread Andrej Valek via lists.openembedded.org
After discussion in all parallel threads we proposed following variant which covers both expressed requirements to have very small number of different cve statuses and also very large number of them at the same time. This is a compromise version which maybe is not ideal but deals with conflicting r

[OE-core][PATCH v7 1/3] cve-check: add option to add additional patched CVEs

2023-06-21 Thread Andrej Valek via lists.openembedded.org
From: Andrej Valek - Replace CVE_CHECK_IGNORE with CVE_STATUS to be more flexible. The CVE_STATUS should contain an information about status wich is decoded in 3 items: - generic status: "Ignored", "Patched" or "Unpatched" - more detailed status enum - descriptio

[OE-core][PATCH v7 2/3] oeqa/selftest/cve_check: rework test to new cve status handling

2023-06-21 Thread Andrej Valek via lists.openembedded.org
From: Andrej Valek - After introducing the CVE_STATUS and CVE_CHECK_STATUSMAP flag variables, CVEs could contain a more information for assigned statuses. - Add an example conversion in logrotate recipe. Signed-off-by: Andrej Valek --- meta/lib/oeqa/selftest/cases/cve_check.py | 26

[OE-core][PATCH v7 0/3] CVE-check handling

2023-06-21 Thread Andrej Valek via lists.openembedded.org
After discussion in all parallel threads we proposed following variant which covers both expressed requirements to have very small number of different cve statuses and also very large number of them at the same time. This is a compromise version which maybe is not ideal but deals with conflicting r

[OE-core][PATCH v6 2/2] RFC: oeqa/selftest/cve_check: rework test to new cve status handling

2023-06-20 Thread Andrej Valek via lists.openembedded.org
- After introducing the CVE_STATUS and CVE_CHECK_STATUSMAP flag variables, CVEs could contain a more information for assigned statuses. - Add an example conversion in logrotate recipe. Signed-off-by: Andrej Valek --- meta/lib/oeqa/selftest/cases/cve_check.py | 26

[OE-core][PATCH v6 1/2] RFC: cve-check: add option to add additional patched CVEs

2023-06-20 Thread Andrej Valek via lists.openembedded.org
reason for status Examples of usage: CVE_STATUS[CVE-1234-0001] = "not-applicable-platform: Issue only applies on Windows" CVE_STATUS[CVE-1234-0002] = "fixed-version: Fixed externally" CVE_CHECK_STATUSMAP[not-applicable-platform] = "Ignored" CVE_CHECK_STATUSMAP[fix

[OE-core][PATCH v6 0/2] RFC: CVE-check handling

2023-06-20 Thread Andrej Valek via lists.openembedded.org
After discussion in all parallel threads we proposed following variant which covers both expressed requirements to have very small number of different cve statuses and also very large number of them at the same time. This is a compromise version which maybe is not ideal but deals with conflicting r

Re: [OE-core][dunfell][PATCH 2/2] curl: whitelists CVE-2022-42915, CVE-2022-42916 and CVE-2022-43551

2023-06-12 Thread Andrej Valek via lists.openembedded.org
This was sent by misstate, ignore it please. Andrej On Mon, 2023-06-12 at 13:57 +0200, Andrej Valek wrote: > All mentioned CVEs are related to HSTS check feature, which is not > implemented in version 7.69.1 . > > Signed-off-by: Andrej Valek > --- >  meta/recipes-support/c

[OE-core][PATCH v5 2/2] oeqa/selftest/cve_check: add check for opt "detail" and "description" values

2023-06-12 Thread Andrej Valek via lists.openembedded.org
- After introducing the CVE_STATUS_DETAIL and CVE_STATUS_DESCRIPTION flag variables, CVEs could contain a more information for assigned statuses. - Add an example conversion in logrotate recipe. Signed-off-by: Andrej Valek --- meta/lib/oeqa/selftest/cases/cve_check.py | 26

[OE-core][dunfell][PATCH 2/2] curl: whitelists CVE-2022-42915, CVE-2022-42916 and CVE-2022-43551

2023-06-12 Thread Andrej Valek via lists.openembedded.org
All mentioned CVEs are related to HSTS check feature, which is not implemented in version 7.69.1 . Signed-off-by: Andrej Valek --- meta/recipes-support/curl/curl_7.69.1.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support

[OE-core][PATCH v5 1/2] cve-check: add option to add additional patched CVEs

2023-06-12 Thread Andrej Valek via lists.openembedded.org
002" CVE_STATUS_WIN[status] = "Ignored" CVE_STATUS_DETAIL[detail] = "not-applicable-platform" CVE_STATUS_WIN[description] = "Issue only applies on Windows" CVE_STATUS_PATCHED = "CVE-1234-0003 CVE-1234-0004" CVE_STATUS_PATCHED[status] = "Patched"

[OE-core][PATCH v5 0/2] CVE-check handling

2023-06-12 Thread Andrej Valek via lists.openembedded.org
After discussion in all parallel threads we proposed following variant which covers both expressed requirements to have very small number of different cve statuses and also very large number of them at the same time. This is a compromise version which maybe is not ideal but deals with conflicting r

Re: [OE-core][PATCH v3 1/3] cve-check: add option to add additional patched CVEs

2023-05-29 Thread Andrej Valek via lists.openembedded.org
Hello again Richard, Maybe this email was little bit unclear..., so I will try to recap it here. There are 2 open points, where some final decision has to be made. - Could we rename the CVE_STATUS_REASONING -> CVE_STATUS_REASON? The first idea came from you. - What is the final enum for CVE_STATU

[OE-core][PATCH v2] busybox: 1.36.0 -> 1.36.1

2023-05-25 Thread Andrej Valek via lists.openembedded.org
- regression on x86 is still in place Signed-off-by: Andrej Valek --- .../{busybox-inittab_1.36.0.bb => busybox-inittab_1.36.1.bb}| 0 .../busybox/{busybox_1.36.0.bb => busybox_1.36.1.bb}| 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-core/b

Re: [OE-core][PATCH v3 1/3] cve-check: add option to add additional patched CVEs

2023-05-23 Thread Andrej Valek via lists.openembedded.org
Hello Richard, Could you please take a look on the latest revision a make a decision there? There are still bunch of unclear statements. So please make a final design and we will try to implement it. Thank you, Andrej On Mon, 2023-05-22 at 10:57 +0300, Mikko Rapeli wrote: > Hi, > > On Fri, May

Re: [OE-core][PATCH v3 1/3] cve-check: add option to add additional patched CVEs

2023-05-20 Thread Andrej Valek via lists.openembedded.org
them will break my parsing and status scripts each time. On Fri, May 19, 2023 at 8:24 AM Andrej Valek via lists.openembedded.org<http://lists.openembedded.org> mailto:siemens@lists.openembedded.org>> wrote: - Replace CVE_CHECK_IGNORE with CVE_STATUS + [CVE_STATUS_REASONING

Re: [OE-core][PATCH v4 1/3] cve-check: add option to add additional patched CVEs

2023-05-19 Thread Andrej Valek via lists.openembedded.org
gt; Hi Andrej, > > On 19.05.23 at 10:18, Andrej Valek via lists.openembedded.org wrote: > > - Replace CVE_CHECK_IGNORE with CVE_STATUS + [CVE_STATUS_REASONING] to be > > more flexible. CVE_STATUS should contain flag for each CVE with accepted > > values "Ignored", "

[OE-core][PATCH v4 3/3] cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS and CVE_STATUS_REASONING

2023-05-19 Thread Andrej Valek via lists.openembedded.org
- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version Signed-off-by: Andrej Valek Reviewed-by: Peter Marko --- .../distro/include/cve-extra-exclusions.inc | 281 +++--- meta/recipes-bsp/grub/grub2.inc

[OE-core][PATCH v4 2/3] oeqa/selftest/cve_check: add check for optional "reason" value

2023-05-19 Thread Andrej Valek via lists.openembedded.org
- After introducing the CVE_STATUS_REASONING flag variable, CVEs could contain a reason for assigned statuses. - Add an example conversion in logrotate recipe. Signed-off-by: Andrej Valek --- meta/lib/oeqa/selftest/cases/cve_check.py | 20 ++- .../logrotate/logrotate_3.21.0

[OE-core][PATCH v4 1/3] cve-check: add option to add additional patched CVEs

2023-05-19 Thread Andrej Valek via lists.openembedded.org
s" CVE_STATUS_GROUPS = "CVE_STATUS_WIN CVE_STATUS_PATCHED" CVE_STATUS_WIN = "CVE-1234-0001 CVE-1234-0002" CVE_STATUS_WIN[status] = "Not applicable" CVE_STATUS_WIN[reason] = "Issue only applies on Windows" CVE_STATUS_PATCHED = "CVE-1234-0003 CVE-123

[OE-core][PATCH v3 3/3] cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS and CVE_STATUS_REASONING

2023-05-18 Thread Andrej Valek via lists.openembedded.org
- Try to add convert and apply statuses for old CVEs Signed-off-by: Andrej Valek Reviewed-by: Peter Marko --- .../distro/include/cve-extra-exclusions.inc | 281 +++--- meta/recipes-bsp/grub/grub2.inc | 9 +- meta/recipes-connectivity/avahi/avahi_0.8.bb | 4

[OE-core][PATCH v3 2/3] oeqa/selftest/cve_check: add check for optional "reason" value

2023-05-18 Thread Andrej Valek via lists.openembedded.org
- After introducing the CVE_STATUS_REASONING flag variable, CVEs could contain a reason for assigned statuses. - Add an example conversion in logrotate recipe. Signed-off-by: Andrej Valek --- meta/lib/oeqa/selftest/cases/cve_check.py | 20 ++- .../logrotate/logrotate_3.21.0

[OE-core][PATCH v3 1/3] cve-check: add option to add additional patched CVEs

2023-05-18 Thread Andrej Valek via lists.openembedded.org
s" CVE_STATUS_GROUPS = "CVE_STATUS_WIN CVE_STATUS_PATCHED" CVE_STATUS_WIN = "CVE-1234-0001 CVE-1234-0002" CVE_STATUS_WIN[status] = "Not applicable" CVE_STATUS_WIN[reason] = "Issue only applies on Windows" CVE_STATUS_PATCHED = "CVE-1234-0003 CVE-123

[OE-core][PATCH v2] cve-check: add option to add additional patched CVEs

2023-05-16 Thread Andrej Valek via lists.openembedded.org
234-0001] = "Not applicable" or "Ignored" CVE_STATUS[CVE-1234-0002] = "Not applicable" CVE_STATUS_REASONING[CVE-1234-0002] = "Issue only applies on windows" Signed-off-by: Andrej Valek --- meta/classes/cve-check.bbclass | 30 +-

Re: [OE-core][PATCH] cve-check: add option to add additional patched CVEs

2023-05-05 Thread Andrej Valek via lists.openembedded.org
On Fri, 2023-05-05 at 12:30 +0100, Richard Purdie wrote: > On Fri, 2023-05-05 at 13:18 +0200, Andrej Valek via > lists.openembedded.org wrote: > > CVE_CHECK_PATCHED - should contains an additional CVEs which have > > been > > fixed and shouldn't be mark as vulnerable

[OE-core][PATCH] cve-check: add option to add additional patched CVEs

2023-05-05 Thread Andrej Valek via lists.openembedded.org
CVE_CHECK_PATCHED - should contains an additional CVEs which have been fixed and shouldn't be mark as vulnerable nor ignored. Signed-off-by: Andrej Valek --- meta/classes/cve-check.bbclass | 8 1 file changed, 8 insertions(+) diff --git a/meta/classes/cve-check.bbclass b/meta/cl

Re: [OE-core][dunfell][PATCH 2/2] curl: whitelists CVE-2022-42915, CVE-2022-42916 and CVE-2022-43551

2023-03-14 Thread Andrej Valek
 AM Steve Sakoman via > lists.openembedded.org > wrote: > > > > On Thu, Mar 9, 2023 at 11:54 PM Andrej Valek > > wrote: > > > > > > All mentioned CVEs are related to HSTS check feature, which is > > > not > > > implemented in version 7.6

[OE-core][dunfell][PATCH] libarchive: fix CVE-2022-26280

2023-03-14 Thread Andrej Valek
Backport fix from https://github.com/libarchive/libarchive/issues/1672 Signed-off-by: Andrej Valek --- .../libarchive/CVE-2022-26280.patch | 29 +++ .../libarchive/libarchive_3.4.2.bb| 1 + 2 files changed, 30 insertions(+) create mode 100644 meta

Re: [OE-core][dunfell][PATCH] curl: Fix CVE CVE-2021-22897

2023-03-10 Thread Andrej Valek
> > Can you give me the url which is giving the expired certificate > error? > > Thanks! > > Steve > > > Regards, > > Andrej > > > > On Fri, 2023-03-10 at 13:45 +0100, Andrej Valek wrote: > > > https://curl.se/docs/CVE-2021-22897.html > >

Re: [OE-core][dunfell][PATCH] curl: Fix CVE CVE-2021-22897

2023-03-10 Thread Andrej Valek
patch, or apply and remove the whitelist, or remove patch from hardknott? - Https certificate at yocto.io has been expired ;) Regards, Andrej On Fri, 2023-03-10 at 13:45 +0100, Andrej Valek wrote: > https://curl.se/docs/CVE-2021-22897.html > > Signed-off-by: Andrej Valek > --- >  ..

[OE-core][dunfell][PATCH] curl: Fix CVE CVE-2021-22897

2023-03-10 Thread Andrej Valek
https://curl.se/docs/CVE-2021-22897.html Signed-off-by: Andrej Valek --- .../curl/curl/CVE-2021-22897.patch| 73 +++ meta/recipes-support/curl/curl_7.69.1.bb | 1 + 2 files changed, 74 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2021

[OE-core][dunfell][PATCH 2/2] curl: whitelists CVE-2022-42915, CVE-2022-42916 and CVE-2022-43551

2023-03-10 Thread Andrej Valek
All mentioned CVEs are related to HSTS check feature, which is not implemented in version 7.69.1 . Signed-off-by: Andrej Valek --- meta/recipes-support/curl/curl_7.69.1.bb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/meta/recipes-support/curl/curl_7.69.1.bb b/meta/recipes-support

[OE-core][dunfell][PATCH 1/2] curl: Fix CVE CVE-2022-43552

2023-03-10 Thread Andrej Valek
https://curl.se/docs/CVE-2022-43552.html Signed-off-by: Andrej Valek --- .../curl/curl/CVE-2022-43552.patch| 79 +++ meta/recipes-support/curl/curl_7.69.1.bb | 1 + 2 files changed, 80 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2022

[OE-core] curl

2023-03-09 Thread Andrej Valek
Hello Steve, I have a question about curl. Would it be possible to backport some fixes for CVEs from kirkstone to dunfell? CVE-2022-32221 CVE-2022-42915 CVE-2022-42916 CVE-2022-43552 CVE-2022-43551 Thank you, Andrej -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. V

Re: [OE-core] [kirkstone] Google go CVEs

2023-03-07 Thread Andrej Valek
+0100, Alexander Kanavin wrote: > You probably should make a kirkstone mixin layer like we did for > dunfell. > https://git.yoctoproject.org/meta-lts-mixins/ > > Alex > > On Tue, 7 Mar 2023 at 07:32, Andrej Valek > wrote: > > > > Hello everyone, > > > >

[OE-core] [kirkstone] Google go CVEs

2023-03-06 Thread Andrej Valek
Hello everyone, I would like to ask you how to proceed with multiple CVEs for Google Go component in kirkstone branch. CVEs in current version 1.17.13: - CVE-2022-41722 - CVE-2022-41725 - CVE-2022-41724 - CVE-2022-41723 They are fixed in 1.19.6/1.20.1 branches, but a fixing patches are available

Re: [OE-core][PATCH] busybox: 1.35.0 -> 1.36.0

2023-01-13 Thread Andrej Valek
11/logs/stdio > > hmmm yes. I think texrels is the fundamental problem originally. I > will take a look and see if this one is harmless > > > > > On 06/01/2023 12:05:05+0100, Andrej Valek wrote: > > > - update to next (un)stable version 1.36.0 > > > - refresh

Re: [OE-core][PATCH] busybox: 1.35.0 -> 1.36.0

2023-01-08 Thread Andrej Valek
o next (un)stable version 1.36.0 > > > > - refresh defconfig > > > >  - disable new applets (tree, tsort, seedrng) > > > >  - use hw-accel for sha1/256 sums when available > > > > - remove and refresh already merged patches > > > > &g

Re: [OE-core][PATCH] busybox: 1.35.0 -> 1.36.0

2023-01-08 Thread Andrej Valek
4d4a7e ip b7f5d668 sp bfff6610 > error 7 in libc.so[b7eea000+76000] > > and it bails out logging in. > > On Fri, Jan 6, 2023 at 3:05 AM Andrej Valek > wrote: > > > > - update to next (un)stable version 1.36.0 > > - refresh defconfig > >  - disable new

[OE-core][PATCH] busybox: 1.35.0 -> 1.36.0

2023-01-06 Thread Andrej Valek
- update to next (un)stable version 1.36.0 - refresh defconfig - disable new applets (tree, tsort, seedrng) - use hw-accel for sha1/256 sums when available - remove and refresh already merged patches Signed-off-by: Andrej Valek --- ...ab_1.35.0.bb => busybox-inittab_1.36.0.bb} | 0 .../0

[OE-core] eSDK cherry-picks

2022-10-26 Thread Andrej Valek
Hello Steve, Would it be possible to include these commits https://git.yoctoproject.org/poky/commit/?id=4fd15f4e3ad50ba1830b20a5e339d75ebb74a4ce   https://git.yoctoproject.org/poky/commit/?id=7e4b96e911f6b308aa1c970db37881d62ddefcac into kirkstone branch? I guess, some older branches are affected

[OE-core] scripts: include all dependencies in eSDK

2022-10-17 Thread Andrej Valek
Without this recursive dependency on do_build task, eSDK includes only direct image dependencies and there for devtool recipe has to rebuild them all. Resolves: [YOCTO#14626] Signed-off-by: Andrej Valek Signed-off-by: Peter Marko --- scripts/oe-check-sstate | 2 +- 1 file changed, 1 insertion

Re: [OE-core] eSDK dependencies

2022-10-13 Thread Andrej Valek
... tasks without any dependencies build. Looks like, that this is exactly what we wanted to achieve. Let me ask the question about the percentage... why is 28% of match? Regards, Andrej On Thu, 2022-10-13 at 10:15 +, Ross Burton wrote: > > > > On 13 Oct 2022, at 09:23, Andrej Va

Re: [OE-core] eSDK dependencies

2022-10-13 Thread Andrej Valek
Hello again, I had some time and made some more testing. Looks like, that the problematic commits are here: https://github.com/openembedded/openembedded-core/commit/41d7f1aa2cc9ef5dba4db38435402d4c9c0a63e1 https://github.com/openembedded/openembedded-core/commit/6e2cbfc561dac89bf9183d24d90e52f7d9

Re: [OE-core] eSDK dependencies

2022-06-29 Thread Andrej Valek
Hello Richard, Yes, but variants have set SDK_EXT_TYPE=full. Can't say about the pure poky eSDK, but with our layers, size is different. Let's say 2/3 of the "working" one. Do you really need locked-sigs.inc from both variant? I guess, you only need to know if some entries are missing and not the

Re: [OE-core] eSDK dependencies

2022-06-28 Thread Andrej Valek
Hello Richard and Alex, Richard: We tried to revert the commits which you mentioned and it didn't work. Alex: Yes, is fully reproducible on latest master. bitbake core-image-minimal -c populate_sdk_ext eSDK installed via: poky-glibc-x86_64-core-image-minimal-cortexa15t2hf- neon-qemuarm-toolchai

[OE-core] eSDK dependencies

2022-06-27 Thread Andrej Valek
Hello Richard! I have a question related to eSDK dependencies. We're using the dunfell branch were everything related to this eSDK topic works fine. Now we're in the transition phase to new LTS branch, where were we found one big difference between eSDKs. The old variant (dunfell) includes all ap

Re: [OE-core][PATCH] kernel: add missing path to search for debug files

2022-05-11 Thread Andrej Valek
ping On Mon, 2022-01-24 at 08:19 +, Andrej Valek via lists.openembedded.org wrote: > Hello Richard, > > Fine, that we have it, but are you going to take a look on the patch > :) > ? > > Regards, > Andrej > > On Fri, 2022-01-21 at 10:18 +0100, Michael Opdenacke

Re: [OE-core][PATCH] copy_buildsystem: allow more layer paths

2022-03-04 Thread Andrej Valek
rej, > > On Thu, 2022-03-03 at 06:35 +, Andrej Valek wrote: > > Hi Daniel, > > > > Could you please give here the examples how the layer structure looks > > before and after change? I want to see how transformation looks like. > > With a directory-structu

Re: [OE-core][PATCH] copy_buildsystem: allow more layer paths

2022-03-02 Thread Andrej Valek
Hi Daniel, Could you please give here the examples how the layer structure looks before and after change? I want to see how transformation looks like. Regards, Andrej On Wed, 2022-03-02 at 20:05 +0100, Daniel Wagenknecht wrote: > Layers could be located anywhere. The eSDK should work with them e

Re: [OE-core] [PATCH] Revert "featimage: refactor style"

2022-02-02 Thread Andrej Valek
Hello Marek, I think, we have to stop the discussion now, because it is not leading into any conclusion. Anyway, both of us have a different opinion. Maybe rewriting into python will solve it, I won't do that. Cheers, Andrej On Wed, 2022-02-02 at 09:17 +0100, Marek Vasut wrote: > On 2/2/22 07:5

Re: [OE-core] [PATCH] Revert "featimage: refactor style"

2022-02-01 Thread Andrej Valek
Marek, Sorry, but these are still not an arguments, why to do that. On Mon, 2022-01-31 at 10:39 +0100, Marek Vasut wrote: > On 1/31/22 08:01, Valek, Andrej wrote: > > Hi, > > Hello Andrej, > > (please avoid top-posting) > > > Sorry, but personally I don't like your idea. What's the benefit of

[OE-core][PATCH] dhcpcd: add option to set DBDIR location

2022-02-01 Thread Andrej Valek
This will allow to use the different DBDIR location, because the /var/lib could be used as a read-only location. Signed-off-by: Andrej Valek --- meta/recipes-connectivity/dhcpcd/dhcpcd_9.4.1.bb | 11 +++ 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/meta/recipes

Re: [OE-core] [PATCH] Revert "featimage: refactor style"

2022-01-30 Thread Andrej Valek
Hi, Sorry, but personally I don't like your idea. What's the benefit of reverting this? I would keep the ${} for bitbake and $ for shell. The {} has to be placed only for variables like $a${b}c. We should respect the workflow on all recipes otherwise we're braking the "unwritten" rules. Regards,

Re: [OE-core] [dunfell][PATCH RFC] busybox.inc: Create temporary busybox links during install

2022-01-28 Thread Andrej Valek
Hello Bryan, So looks like, there is some kind of problem. Was you able to run the busybox command after upgrade like, "busybox ls /" ? - If yes, there is a problem, that update alternatives hasn't been processed correctly. Try direct command after reboot, if possible - If no, lets continue wit

[OE-core][PATCH] oeqa: qemu: create missing directory for _write_dump

2022-01-28 Thread Andrej Valek
block' | Failed to dump QMP CMD: dump-guest-memory with | Exception: [Errno 2] No such file or directory: '.../tmp/log/runtime-hostdump/qmp_00_dump-guest-memory' The qmp dump commands could fail, because of missing root directory. So create it before any log writing. Signed-off-b

Re: [OE-core][PATCH] kernel: add missing path to search for debug files

2022-01-24 Thread Andrej Valek
Hello Richard, Fine, that we have it, but are you going to take a look on the patch :) ? Regards, Andrej On Fri, 2022-01-21 at 10:18 +0100, Michael Opdenacker wrote: > > On 1/19/22 5:48 PM, Richard Purdie wrote: > > On Wed, 2022-01-19 at 12:57 +0100, Andrej Valek wrote: > >

[OE-core][PATCH] busybox: refresh defconfig

2022-01-24 Thread Andrej Valek
- extend find command - disable rootfs skip - busybox-inittab_1.34.1 -> busybox-inittab_1.35.0 Signed-off-by: Andrej Valek --- ...ab_1.34.1.bb => busybox-inittab_1.35.0.bb} | 0 meta/recipes-core/busybox/busybox/defconfig | 70 +++ 2 files changed, 39 insertions(

Re: [OE-core] [dunfell][PATCH RFC] busybox.inc: Create temporary busybox links during install

2022-01-21 Thread Andrej Valek
Hello again, Maybe a general question. Is it working in current master? I do not want to brake dunfell, just applying something, which will create a lot of divergence. Cheers, Andrej On Fri, 2022-01-21 at 15:02 +, Bryan Evenson wrote: > Andrej, > > Thanks for the response.  This is an attem

Re: [OE-core] [dunfell][PATCH RFC] busybox.inc: Create temporary busybox links during install

2022-01-21 Thread Andrej Valek
Hi Bryan, Sorry, maybe I didn't fully understand the use-case. Are you trying to upgrade the busybox on demand? If yes, that is not a good idea. I'm little bit scary about doing "export PATH=$busybox_rmdir:$PATH" and creating a custom locks is not a good at all. Cheers, Andrej On Fri, 2022-01-2

  1   2   3   4   >