summaryrefslogtreecommitdiffstats
path: root/meta/recipes-core/meta
AgeCommit message (Collapse)Author
12 daysbuildtools-tarball: Add python3-pipRichard Purdie
Many of the common use cases for buildtools need pip to allow python to be extended. Add it. (From OE-Core rev: 946086abf5ac5172258ddb27af9c1c615258f62f) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-04-14buildtools-tarball: Add python3-setuptoolsRichard Purdie
After the dependency on setuptools was dropped from python3-testtools, this exposed eSDK dependencies in devtool and recipetool on python3-setuptools. Add this to buildtools to fix build failures after the testtools fixes. (From OE-Core rev: c4431b4dd27d290024472f315858a63aea2a733c) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-04-14buildtools-tarball: Add python3-websocketsRichard Purdie
For the newer hash equivlance servers we need websockets. Add it to buildtools tarball. (From OE-Core rev: 3f2b5f6c3af04c8ec245aca35224c52230645bf0) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-15cve-update-nvd2-native: Remove rejected CVE from databaseYoann Congal
When a CVE is updated to be rejected, matching database entries must be removed. Otherwise: * an incremental update is not equivalent the to an initial download. * rejected CVEs might still appear as Unpatched in cve-check. (From OE-Core rev: f276a980b8930b98e6c8f0e1a865d77dfcfe5085) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-15cve-update-nvd2-native: Fix CVE configuration updateYoann Congal
When a CVE is created, it often has no precise version information and this is stored as "-" (matching any version). After an update, version information is added. The previous "-" must be removed, otherwise, the CVE is still "Unpatched" for cve-check. (From OE-Core rev: 641ae3f36e09af9932dc33043a0a5fbfce62122e) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-15cve-update-nvd2-native: nvd_request_next: Improve commentYoann Congal
Add a URL to the doc of the API used in the function. ... and fix a small typo dabase -> database (From OE-Core rev: e0157b3b81333a24abd31dbb23a6abebca3e7ba7) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-15cve-update-nvd2-native: Remove duplicated CVE_CHECK_DB_FILE definitionYoann Congal
CVE_CHECK_DB_FILE is already defined in cve-check.bbclass which is always inherited in cve-update-nvd2-native (There is a check line 40). Remove it to avoid confusion. Otherwise, this should not change anything. (From OE-Core rev: e5f3f223885c17b7007c310273fc7c80b90a4105) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-13cve-update-nvd2-native: Add an age threshold for incremental updateYoann Congal
Add a new variable "CVE_DB_INCR_UPDATE_AGE_THRES", which can be used to specify the maximum age of the database for doing an incremental update For older databases, a full re-download is done. With a value of "0", this forces a full-redownload. (From OE-Core rev: 74c1765111b6610348eae4b7e41d7045ce58ef86) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-13cve-update-nvd2-native: Fix typo in commentYoann Congal
attmepts -> attempts (From OE-Core rev: dc18aaeda8e810f9082a0ceac08e5e4275bbd0f7) Signed-off-by: Yoann Congal <yoann.congal@smile.fr> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2024-03-05bmaptool: now part of Yocto ProjectTrevor Woerner
The bmaptool (previously: bmap-tools, bmap-tool, bmaptool) has been moved to be under the Yocto Project umbrella and is now hosted at: github.com/yoctoproject/bmaptool [RP: Added a couple of missing renames] (From OE-Core rev: 7a036b1a1ec7dcd27dbe18d4c2e703bd2a8af182) Signed-off-by: Trevor Woerner <twoerner@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-13cve-update-nvd2-native: increase the delay between subsequent request failuresDhairya Nagodra
Sometimes NVD servers are unstable and return too many errors. There is an option to have higher fetch attempts to increase the chances of successfully fetching the CVE data. Additionally, it also makes sense to progressively increase the delay after a failed request to an already unstable or busy server. The increase in delay is reset after every successful request and the maximum delay is limited to 30 seconds. Also, the logs are improved to give more clarity. (From OE-Core rev: 7101d654635b707e56b0dbae8c2146b312d211ea) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-13cve-update-nvd2-native: faster requests with API keysDhairya Nagodra
As per NVD, the public rate limit is 5 requests in 30s (6s delay). Using an API key increases the limit to 50 requests in 30s (0.6s delay). However, NVD still recommends sleeping for several seconds so that the other legitimate requests are serviced without denial or interruption. Keeping the default sleep at 6 seconds and 2 seconds with an API key. For failures, the wait time is unchanged (6 seconds). Reference: https://nvd.nist.gov/developers/start-here#RateLimits (From OE-Core rev: 5c32e2941d1dc3d04a799a1b7cbd275c1ccc9e79) Signed-off-by: Dhairya Nagodra <dnagodra@cisco.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-02cve-update-nvd2-native: make number of fetch attemtps configurablePeter Marko
Sometimes NVD servers are unstable and return too many errors. Last time we increased number of attempts from 3 to 5, but further increasing is not reasonable as in normal case too many retries is just abusive. Keep retries low as default and allow to increase as needed. (From OE-Core rev: 6b6fd8043d83b99000054ab6ad2c745d07c6bcc1) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-12-02cve-update-nvd2-native: remove unused variable CVE_SOCKET_TIMEOUTPeter Marko
This variable is not referenced in oe-core anymore. (From OE-Core rev: 905b45a814cb33327503b793741c19b44c8550b3) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-28cve-check: add CVSS vector string to CVE database and reportsAntoine Lubineau
This allows building detailed vulnerability analysis tools without relying on external resources. (From OE-Core rev: 048ff0ad927f4d37cc5547ebeba9e0c221687ea6) Signed-off-by: Antoine Lubineau <antoine.lubineau@easymile.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-22recipes: Drop remaining PR values from recipesRichard Purdie
We've been removing PR values from recipes at upgrade time for a while. In general anyone maintaining a binary distro would end up having to curate these themselves so the values in OE-Core aren't really that useful anymore. In many ways it makes sense to clear out the remaining ones (which are mostly for 'config' recipes that are unlikely to increase in PV) and leave a clean slate for anyone implementing a binary distro config. References are left in meta-selftest since the tests there do involve them and their removal upon upgrade. (From OE-Core rev: d4c346e8ab8f3cae25d1b01c7331ed9f6d4f96ef) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-09-09build-sysroots: target or native sysroot population need to be selected ↵Alexander Kanavin
explicitly Running them in parallel is prone to races as postinsts from target sysroots rely on executables from native sysroots which may or may not be fully prepared yet. This was observed for example here: https://autobuilder.yoctoproject.org/typhoon/#/builders/146/builds/468/steps/12/logs/stdio https://autobuilder.yoctoproject.org/typhoon/#/builders/147/builds/467/steps/12/logs/stdio (From OE-Core rev: 38d7a2e45b883cf999a86af05bcc0eaa875bb47c) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-08-29buildtools-tarball: Add libaclJoshua Watt
Hash equivalence need to include the ACLs in the output hash, and libacl is used to do that so include the library in the buildtools-tarball. (From OE-Core rev: d152dfe784f231fa369d59f9bce8195ad09c5482) Signed-off-by: Joshua Watt <JPEWhacker@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-08-22build-sysroots: Ensure dependency chains are minimalRichard Purdie
We need to ensure this recipe doesn't have dependencies on others. The SPDX classes/tasks introduce dependenies quilt-native and patch-native which can introduce races on files in the sysroots. Avoid the races by removing the tasks we don't need. [YOCTO #15186] (From OE-Core rev: a5dc278b077edba8f4099f0f6dfb97e97f680320) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-08-21build-sysroots: Add SUMMARY fieldKhem Raj
Fixes build QA warning about [missing-metadata] (From OE-Core rev: 4f4c7130f11c069ab18c374dcbfb1276ef37be60) Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-30buildtools-extended-tarball: install the full set of gconv modulesAlexander Kanavin
The specific set was written to ensure vim builds reproducibly; this is however prone to silent regressions (if vim adds more usage of iconv with different encodings). Installing the full set also matches what standard desktop distributions do, and thus meets expectations of upstream projects in general. (From OE-Core rev: 2685c497c14bc325500053e551d97e8cbda97252) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-30uninative-tarball: install the full set of gconv modulesAlexander Kanavin
msgfmt from gettext-native 0.22 is using iconv() to convert data to utf-8 from arbitrary source encodings (previous versions of gettext did not do this conversion): https://git.savannah.gnu.org/gitweb/?p=gettext.git;a=commit;h=5412a4f79929004cb6db15d545e07dc953330e8d As this is happening at build time, and the source encodings are specified by upstream projects in translation files, we need the full set to cover all of them. (From OE-Core rev: 8a23d9f499c7784379822ef69f4812a562a90887) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-13cve-update-nvd2-native: actually use API keysRoss Burton
There were vestigal remains of API key support which could be removed, but as using an API key - in theory - gives the user larger rate limits it's probably wise to expose it. If the user has an API key, then set NVDCVE_API_KEY. (From OE-Core rev: a542de684282bfec79f24ae2f1a2027ffde319d8) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-13cve-update-nvd2-native: log a little moreRoss Burton
Add a note of what range we're fetching, and use bb.note() instead of debug() as messages about retrying shouldn't really be considered debug logging. (From OE-Core rev: b64a869b9c5e1d504f1011da16b5c5ff721afbf0) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-13cve-update-nvd2-native: increase retry countPeter Marko
Current 503 errors seem to last several seconds. In most cases there are two errors and third request succeeds. However sometimes the outage takes more than time needed for two retries and third one also fails. Extend retry count from 3 to 5 to improve the probablity that the fetcher succeeds. (From OE-Core rev: f4d118af2360cff7f234102fd5e4b65a6f4146a6) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-13cve-update-nvd2-native: retry all errors and sleep between retriesPeter Marko
Last couple days it is not possible to update NVD DB as servers are returning lot of errors. Mostly "HTTP Error 503: Service Unavailable" is observed but sporadially also some others. Retrying helps in most cases, so extend retries to all errors. Additionally add sleep which is recommended by NVD between requests. These retries are already implemented between successful requests, but giving servers time between failed ones is important, too. (From OE-Core rev: 88dad8f198baa80af5ab576498f4df6ed639d551) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-07-10cve-update-nvd2-native: fix cvssV3 metricsPeter Marko
After upgrade to soon-to-be-released kirkstone 4.0.11 CVE annotations got broken. Anything which has only cvssV3 does not resolve properly. Fix the API fields used to extract it. i0.0 score is now at level of NVD DB 1.1. All CVEs with UNKNOWN vector are not present in NVD DB 1.1. NVD API 1.1: sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4776 LOCAL|32146 NETWORK|167746 PHYSICAL|185 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73331 1.8|7 1.9|3 ... NVD API 2.0 (broken): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|4587 LOCAL|26273 NETWORK|150421 UNKNOWN|24644 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|205925 NVD API 2.0 (fixed): sqlite> select vector, count(vector) from nvd group by vector; ADJACENT_NETWORK|5090 LOCAL|32322 NETWORK|168004 PHYSICAL|213 UNKNOWN|511 sqlite> select scorev3, count(scorev3) from nvd group by scorev3; 0.0|73841 1.8|7 1.9|3 ... (From OE-Core rev: 61a5857efdcc0f49c69c0deb24fce99007aeef19) Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-27cve-update-nvd2-native: use exact times, don't truncateRoss Burton
When requesting updates in a specific range, use the actual current time and database mtime instead of truncating to midnight, and explicitly set the timezone to UTC so that NIST don't treat the timestamps as _their_ local time when they're _our_ local time. (From OE-Core rev: 9aa0ec37f5f74252588d2494a71c71a7d8e68df9) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-27cve-update-nvd2-native: handle all configuration nodes, not just firstRoss Burton
Some CVEs, such as CVE-2013-6629, list multiple configurations which are vulnerable. The current JSON parser only considers the first configuration. Instead, consider every configuration. We don't yet handle the AND/OR logical operators, but this is a step in the right direction. (From OE-Core rev: e1bf4f6dd686055fe9a8bdcc3f739eac2807bae0) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-27cve-update-db-native: removeRoss Burton
The replacement cve-update-nvd2-native is working, so we can remove the old recipe now. (From OE-Core rev: 17eb07885147a06bf7bdd43f7869fe4411be80a0) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-06-01meta-world-pkgdata: Fix for create-spdxRichard Purdie
(From OE-Core rev: 981917eaa347c7660f0ed3fae436359cd61baf29) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-04-14cve-update-nvd2-native: added the missing http importJan Vermaete
(From OE-Core rev: 39d2cde7eb922cb0a2cf9402cd8b3ae3b4cc2f62) Signed-off-by: Jan Vermaete <jan.vermaete@gmail.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-04-01cve-update-nvd2-native: new CVE database fetcherMarta Rybczynska
Add new fetcher for the NVD database using the 2.0 API [1]. The implementation changes as little as possible, keeping the current database format (but using a different database file for the transition period), with a notable exception of not using the META table. Minor changes that could be visible: - the database starts in 1999 instead of 2002 - the complete fetch is longer (30 minutes typically) [1] https://nvd.nist.gov/developers/vulnerabilities (From OE-Core rev: fb62c4c3dbca4e58f7ce6cf29d4b630a06411a97) Signed-off-by: Marta Rybczynska <marta.rybczynska@syslinbit.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-03-11buildtools-tarball: Handle spaces within user $PATHKenfe-Mickael Laventure
The environment-setup script generated by the recipe was not quoting the user existing PATH when updating it causing the export command to fail. Add necessary double quotes around $PATH. (From OE-Core rev: 2d4c032bf3187aaa953a0c33a999074e695f54bb) Signed-off-by: Kenfe-Mickael Laventure <mickael.laventure@gmail.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-29Revert "cve-update-db-native: show IP on failure"Ross Burton
The bug this was intended to find has been resolved, so we don't need this extra noise in the logs. This reverts commit bd1edfa3d5b1c24cd1192620f7085ee1df03e1af. (From OE-Core rev: 54ae53ef3e4ad51fc9a01155588b62f29c994742) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-26buildtools-tarball: set pkg-config search pathRoss Burton
The buildtools-tarball includes a native sysroot with .pc files, and in the case of buildtools-extended-tarball a pkg-config binary too. If we're using the host pkg-config then it doesn't know to search in the native sysroot. If we're using our pkg-config then it searches in the build-time prefix and not the actual SDK installation location. Neither of these are correct, so set PKG_CONFIG_LIBDIR to search: - The native sysroot - The host pkg-config's default search path, if present - Falling back to /usr/lib/pkgconfig, if not In an ideal world this would be handled by the generic toolchain script, but that is slightly more involved. [ YOCTO #15007 ] (From OE-Core rev: 8f768a3f4c7ff477e994d60800e5a1b83891615a) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-14cve-update-db-native: show IP on failureRoss Burton
We get random SSL failures when fetching the CVE database, and it's notable that the NVD server is behind a DNS round-robin or geographically diverse servers. On a hunch that there is one misconfigured server, dump the IP that we connected to. (From OE-Core rev: 91f46d431dc8f40e8c6475c800bb61cb08b82b0a) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-09uninative-tarball: Add libgccRichard Purdie
We ship libpthread with uninative. when uninative is active we're seeing failures like: libgcc_s.so.1 must be installed for pthread_cancel to work Aborted which is since we don't have a libgcc that matches libpthread. Add libgcc to avoid these errors. (From OE-Core rev: a134a7186b2266378bc0b08c134e169a943eedde) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2023-01-06cve-update-db-native: avoid incomplete updatesMarta Rybczynska
The database update has been done on the original file. In case of network connection issues, temporary outage of the NVD server or a similar situation, the function could exit with incomplete data in the database. This patch solves the issue by performing the update on a copy of the database. It replaces the main one only if the whole update was successful. See https://bugzilla.yoctoproject.org/show_bug.cgi?id=14929 Reported-by: Alberto Pianon <alberto@pianon.eu> (From OE-Core rev: 8efe99214d8b005f0ecac690ce5ba17b31758f92) Signed-off-by: Marta Rybczynska <marta.rybczynska@linaro.org> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-26buildtools-tarball: export certificates to python and curlJan-Simon Moeller
The custom path of the ca-certificates.crt within the buildtools-tarball requires more environment variables to be exported. Namely REQUESTS_CA_BUNDLE for the python requests library and CURL_CA_BUNDLE for curl. (From OE-Core rev: 5c249db9de8ad8cfe0996ff4fee4c575a5ff1e34) Signed-off-by: Jan-Simon Moeller <jsmoeller@linuxfoundation.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-10-25cve-update-db-native: add timeout to urlopen() callsFrank de Brabander
The urlopen() call can block indefinitely under some circumstances. This can result in the bitbake process to run endlessly because of the 'do_fetch' task of cve-update-bb-native to remain active. This adds a default timeout of 60 seconds to avoid this hang, while being large enough to minimize the risk of unwanted timeouts. (From OE-Core rev: e5f6652854f544106b40d860de2946954de642f3) Signed-off-by: Frank de Brabander <debrabander@gmail.com> Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-09-02cve-check: close cursors as soon as possibleRoss Burton
We can have multiple processes reading the database at the same time, and cursors only release their locks when they're garbage collected. This might be the cause of random sqlite errors on the autobuilder, so explicitly close the cursors when we're done with them. (From OE-Core rev: 5d2e90e4a58217a943ec21140bc2ecdd4357a98a) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-12testexport: Fix to work as an image classRichard Purdie
The class is mainly an image based class but one recipe does need to look at values shared with the class and isn't an image. Move this to a conf file instead, avoiding the need to pollute all recipes globally. (From OE-Core rev: ed4238487c81b3580e83c257b50745a832a6e717) Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-08-02wic: depend on cross-binutilsRoss Burton
Wic can build an unified kernel image, but this needs the cross-objcopy from binutils. (From OE-Core rev: 7c7a488116f49083ca42d3628ebc0870585110c3) Signed-off-by: Ross Burton <ross.burton@arm.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-07-28meta-ide-support: adjust to provide (e)SDK experience directly in a yocto buildAlexander Kanavin
Specifically: 1. Add a few more toolchain items to DEPENDS so they're available in the recipe sysroot. 2. Use deploy mechanism to place the SDK environment setup file and testdata for testing it into the image deploy directory. 3. Add ability to run SDK tests via the testsdk class and task. This also requires providing a testdata json file. 4. Ensure sysroot population always runs, as those items are mean to be picked up by 'bitbake build-sysroots' into the unified sysroot. (From OE-Core rev: 93f419451cc18b5d31b6fe134ca52a2750fa567d) Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-21signing-keys: fix RDEPENDS to signing-keys-devFederico Pellegrin
Specific provider (ie. RPM or IPK) does "provide" just itself as a package to the system. This will cause the "-dev" package, which refers to the generic signing-keys and not the provider specific, to miss the dependency. Error case (RPM) when populating sdk: Error: Problem: conflicting requests - nothing provides signing-keys = 1.0-r0 needed by signing-keys-dev-1.0-r0.noarch (try to add '--skip-broken' to skip uninstallable packages) Examining signing-keys-rpm packages in PROVIDES we have indeed: signing-keys-rpm = 1.0-r0 But in signing-keys-dev: in REQUIRES: signing-keys-1.0-r0 This MR will fix the situation by removing the RDEPENDS for the -dev package (From OE-Core rev: ecdba906c3c8bc21e33b4a2651a762c40487149b) Signed-off-by: Federico Pellegrin <fede@evolware.org> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-06-06cve-update-db-native: make it possible to disable database updatesMarta Rybczynska
Make it possible to disable the database update completely by using a negative update interval CVE_DB_UPDATE_INTERVAL. Disabling the update is useful when running multiple parallel builds when we want to have a control on the database version. This allows coherent cve-check results without an database update for only some of the builds. (From OE-Core rev: b5c2269240327c2a8f93b9e55354698f52c976f3) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-03cve-update-db-native: let the user to drive the update intervalMarta Rybczynska
Add a new variable CVE_DB_UPDATE_INTERVAL allowing the user to set the database update interval. - a positive value sets an interval (in seconds) - a zero ("0") forces the database update (From OE-Core rev: fe7bc6f16184d5ebdb1dd914b6dcb75c9e5e0c9c) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-05-03cve-update-db-native: update the CVE database once a day onlyMarta Rybczynska
The update of the NVD database was expected to happen once per hour. However, the database file date changes only if the content was actually updated. In practice, the check worked for the first hour after the new download. As the NVD database changes usually only once a day, we can just update it less frequently. (From OE-Core rev: 35bccdedadeaba820d58b69fe74ce5e4c1f577e3) Signed-off-by: Marta Rybczynska <marta.rybczynska@huawei.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2022-04-27wic: Add dependencies for erofs-utilsSean Anderson
In order to build erofs filesystems, wic must have the erofs-utils package installed into its sysroot. Fixes: 30375ce97 ("Add support for erofs filesystems") (From OE-Core rev: 68e364340c439a1341d37c3f7a2b0e6aad8e1e56) Signed-off-by: Sean Anderson <sean.anderson@seco.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-04-28 09:42:23 +0000