* CVE detail: https://nvd.nist.gov/vuln/detail/CVE-2018-1000156
* upstream tracking: https://savannah.gnu.org/bugs/index.php?53566
* Fix arbitrary command execution in ed-style patches:
- src/pch.c (do_ed_script): Write ed script to a temporary file instead
of piping it to ed: this will cause ed to abort on invalid commands
instead of rejecting them and carrying on.
- tests/ed-style: New test case.
- tests/Makefile.am (TESTS): Add test case.
(From OE-Core rev: 6b6ae212837a07aaefd2b675b5b527fbce2a4270)
(From OE-Core rev: 413c54e0698589b17976e88fa7ab76e5dbac51aa)
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Signed-off-by: Armin Kuster <akuster@mvista.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These are recipes where the upstream has moved to GPLv3 and these old
versions are the last ones under the GPLv2 license.
There are several reasons for making this move. There is a different
quality of service with these recipes in that they don't get security
fixes and upstream no longer care about them, in fact they're actively
hostile against people using old versions. The recipes tend to need a
different kind of maintenance to work with changes in the wider ecosystem
and there needs to be isolation between changes made in the v3 versions
and those in the v2 versions.
There are probably better ways to handle a "non-GPLv3" system but right
now having these in OE-Core makes them look like a first class citizen
when I believe they have potential for a variety of undesireable issues.
Moving them into a separate layer makes their different needs clearer, it
also makes it clear how many of these there are. Some are probably not
needed (e.g. mc), I also wonder whether some are useful (e.g. gmp)
since most things that use them are GPLv3 only already. Someone could
now more clearly see how to streamline the list of recipes here.
I'm proposing we mmove to this separate layer for 2.3 with its future
maintinership and testing to be determined in 2.4 and beyond.
(From OE-Core rev: 19b7e950346fb1dde6505c45236eba6cd9b33b4b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix a variety of problems such as typos, bad punctuations, or incorrect
Upstream-Status values.
(From OE-Core rev: bd220fe6ce8c3a0805f13a14706d3130ea872604)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This is same gnulib fix replicated across needed recipes
Change-Id: I756713407111a726eae98e26c9c1ff64981371c0
(From OE-Core rev: fbe6d2c12aa9f7956bc87efeb68cb64b26b60c7a)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fixed:
WARNING: QA Issue: patch: configure was passed unrecognised options: --disable-xattr [unknown-configure-option]
The patch 2.5.9 doesn't support --disable-xattr, there are already
PACKAGECONFIG and PACKAGECONFIG[attr] in patch_2.7.1.bb, so remove them from
patch.inc to fix the problem.
(From OE-Core rev: 7d10af1954aa4f27e3f32b7371a1f2454344bb5f)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The base_contains is kept as a compatibility method and we ought to
not use it in OE-Core so we can remove it from base metadata in
future.
(From OE-Core rev: d83b16dbf0862be387f84228710cb165c6d2b03b)
Signed-off-by: Otavio Salvador <otavio@ossystems.com.br>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Remove all PR = "r0" from all .bb files in oe-core. This was done
with the command sed -e '/^PR.*=.*r0\"/d' recipes*/*/*.bb -i
We've switching to the PR server, PR bumps are no longer needed and
this saves people either accidentally bumping them or forgetting to
remove the lines (r0 is the default anyway).
(From OE-Core rev: 58ae94f1b06d0e6234413dbf9869bde85f154c85)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* it's autodetected from sysroot
* add PACKAGECONFIG to make it deterministic
(From OE-Core rev: 2eb394b6111a7df730e38604e8efe8bce5c1653a)
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This will enable or disable xattr with the correct dependency
on attr as needed.
(From OE-Core rev: dd219cb2608e5800dcd900117b37ad8cf9ac689a)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
There is a optional dependency on xattr (and thus the attr package),
disable it by default, to ensure it builds correctly.
(From OE-Core rev: a7de32c8ad1405ed31b620fb99dfe0fe80ac23a9)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
global-reject-file.diff was patch ported from Debian that Debian
itself has dropped as upstream now has equivalent functionality.
To update users of this functionality, replace
"--global-reject-file=file" with simple "--reject-file=file" which
no longer overwrites reject hunks from different files.
(From OE-Core rev: 1c15ffab4d68e86f1ffcfd538e1d0ab77c21cb97)
Signed-off-by: Marko Lindqvist <cazfi74@gmail.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some place pnum=1 is used which is removed as well since
striplevel=1 is default
(From OE-Core rev: 4e108857e0d40105f7ecbc55e99bd6c367bb7386)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
As discussed on the mailing list, this variable isn't useful and if wanted
would be better implemented by distros using pn-X overrides.
This patch executes:
find . -regex ".*\.\(bb\|inc\)$" | xargs sed -i '/^PRIORITY = ".*"$/d'
against the tree removing the referenced. Thanks to Phil Blundell for
the command.
(From OE-Core rev: d122343362669c683acc4af295971a62cbc823fc)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit patch recipe based on latest upstream code. This is GPLv3
code based. Hence the earlier patch-2.5.9 recipe is left intact for
GPLv2 needs.
Patches from 2.5.9 patch recipe are rebased to this new recipe except
these exceptions:
unified-reject-files.diff: dropped
This patch implements this new parameter:
" --unified-reject-files Create unified reject files."
And upstream has implemented very similar parameter like this:
" --reject-format=FORMAT Create 'context' or 'unified' rejects."
Hence this patch is dropped for the 2.6.1 recipe.
global-reject-file.diff: rebased
This patch is rebased to the newer upstream codebase.
install.patch: dropped
Newer upstream code now includes code form this patch.
debian.patch: dropped
This huge (10k lines) patch was specific for 2.5.9 version of GPLv2 patch.
Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Earlier the recipe was using 2.5.4 tar ball and a patch for upgrading to
2.5.9. Replaces these with pointer to 2.5.9 tarball.
Also noted that both 2.5.4 & 2.5.9 are GPLv2 sources.
Updated checksums and license of the recipe
Signed-off-by: Nitin A Kamble <nitin.a.kamble@intel.com>
Having one monolithic packages directory makes it hard to find things
and is generally overwhelming. This commit splits it into several
logical sections roughly based on function, recipes.txt gives more
information about the classifications used.
The opportunity is also used to switch from "packages" to "recipes"
as used in OpenEmbedded as the term "packages" can be confusing to
people and has many different meanings.
Not all recipes have been classified yet, this is just a first pass
at separating things out. Some packages are moved to meta-extras as
they're no longer actively used or maintained.
Signed-off-by: Richard Purdie <rpurdie@linux.intel.com>
