BMC/OpenBmc/openbmc.git/upstream-layers/meta-security, branch master

meta-security: subtree update:9265f142f3..226839ac40

2026-06-03T12:32:21+00:00

Anton Antonov (2): parsec-service: Update Parsec service version. meta-parsec: Do not run Parsec CI jobs on 32bit platforms. Bin Cao (1): samhain: upgrade 4.5.2 -> 4.5.3 Li Zhou (3): firejail: fix COMPATIBLE_MACHINE setting layer.conf: correct WARN_QA aide-base.bbclass: correct STAGING_AIDE_DIR Peter Marko (2): tpm2-tools: make efivar optional tpm2-pkcs11: upgrade 1.9.1 -> 1.9.2 Ross Burton (3): parsec-service: assign PACKAGECONFIG in one line parsec-service: do group membership modifications in useradd parsec-service: update TS group name Yi Zhao (1): arpwatch: fix typos jason.lau (2): google-authenticator-libpam: update 1.0.9 -> 1.11 aide: fix pkg_postinst_ontarget shell script Change-Id: I2c00effb57ada7a42cf64893a40de7de4c021e7e Signed-off-by: Patrick Williams

meta-security: subtree update:bd6927e1df..9265f142f3

2026-05-14T19:45:21+00:00

Clayton Casciato (1): suricata: update 7.0.13 -> 8.0.4 Marta Rybczynska (1): README: update CI links Scott Murray (10): crowdsec: Upgrade to v1.7.7 aircrack-ng: Upgrade to 1.7 opendnssec: Upgrade to 2.1.14 libmspack: Remove clamav: Upgrade to 1.4.4 aide: Upgrade to 0.19.3 libmhash: Remove ncrack: Update packagegroup-core-security: Add missing packages packagegroup-core-security: remove python3-privacyidea Wenlin Kang (1): krill: fix missing dollar sign in FILES Change-Id: Ia19d119cd33177588b6948d9557d716eebca367b Signed-off-by: Patrick Williams

meta-security: subtree update:8028c573db..bd6927e1df

2026-04-24T20:49:06+00:00

Haiqing Bai (1): isic: fix RDEPNEDS typo Khem Raj (1): wic: wic need to be moved to files/wic within the layer to be found/used Peter Marko (2): libtpms: fix build with glibc 2.43 tpm2-pkcs11: fix build failure Yi Zhao (2): scap-security-guide: upgrade 0.1.78 -> 0.1.80 openscap: upgrade 1.4.2 -> 1.4.3 Zhang Peng (1): meta-security: fix incorrect HOMEPAGE variable names Change-Id: Ie4483b63b984260aa8030285f487f8ff74c37fc7 Signed-off-by: Patrick Williams

meta-security: wic: wic need to be moved to files/wic within the layer to be found/used

2026-04-10T22:44:16+00:00

[1]: https://lore.kernel.org/yocto-patches/20260407224541.3158784-1-khem.raj@oss.qualcomm.com/ (applied from mailing list) Signed-off-by: Khem Raj Signed-off-by: Patrick Williams Change-Id: Ia1a6255068d96b0f69c6e67f9bb3caa67a7de9bc

meta-security: subtree update:9e6d962250..8028c573db

2026-03-28T16:40:38+00:00

Clayton Casciato (1): suricata: improve PACKAGECONFIG[unittests] control Marta Rybczynska (1): layer.conf: Update to wrynose (6.0) release Peter Kjellerstedt (3): fscrypt: Correct the spelling of DESCRIPTION fscryptctl: Use ${prefix} rather than /usr fscryptctl: Correct the spelling of DESCRIPTION Peter Marko (1): python3-tpm2-pytss: BBCLASSEXTEND native and nativesdk Scott Murray (2): nikto: fix branch A couple of small CI fixes Change-Id: I31df975124dd74cda095401b86e8857560973fab Signed-off-by: Patrick Williams

treewide: update release compatibility

2026-03-28T16:39:38+00:00

Latest yocto release will be wrynose; update layer compatibilities accordingly. Squash numerous commits from each upstream-layers subtree: (cherry picked from commit cd1179544d74026c99a4938824146cec4f5acfca) (cherry picked from commit 930a65579d2c159ce0b05cf81916d20a04f5835f) (cherry picked from commit 8028c573db6923525c2918724f2bd36d4a420e0b) (cherry picked from commit 1e4a9929a90a6f9608e8df7ec073d3467b6ee217) (cherry picked from commit a75c2f0b6f9d10c116b3da7106234bce6c8c1a4f) Signed-off-by: Patrick Williams Change-Id: Ia5b19ed374bbc3f7a5aced7ef8bb4ec1f0da9444

meta-security: reset to upstream

2026-03-26T18:25:42+00:00

Reset a few files that were changed downstream to their upstream content. Signed-off-by: Patrick Williams Change-Id: I099af5e2d4da185970e52f64f533af8b02196f18

meta-security: subtree update:06bd60600e..9e6d962250

2026-03-24T11:21:46+00:00

Clayton Casciato (8): suricata: install classification, reference configs suricata: populate SYSTEMD_SERVICE for service autostart suricata-update: add package to pull files suricata: update to 7.0.12 suricata: drop deprecated nss, nspr PACKAGECONFIGs suricata: drop trailing whitespace suricata: update PACKAGECONFIG[jansson] option to required suricata: add PACKAGECONFIG[seccomp] - MemoryDenyWriteExecute Haixiao Yan (2): fail2ban: Adapt test output to Automake format for ptest compatibility fail2ban: replace fail2ban-python shebang with python3 Hemant Jadhav (1): clamav: Add recipe for version 1.4.3 J. S. (1): lib-perl: add a HOMEPAGE. Use CPAN_MIRROR Louis Rannou (2): openscap: fixes oeqa: openscap test Marta Rybczynska (11): gitlab-ci.yml: fix file redirection for qemux86 build logs packagegroup-core-security: unify conditional adding of packages on RISCV checksecurity: update the debian package bastille: prevent host uids on files kas: add common dldir/sstate aide: remove for musl kas: add whitespaces around assignement lynis: move to GitHub fetching chipsec: update to 1.13.16 chipsec: disable until 6.16 support is fixed test: allow root login for test images Michael Opdenacker (2): lynis: homepage update lynis: update to 3.1.5 Patrick Wicki (1): tpm2-tss-engine: remove libgcrypt dependency Scott Murray (12): tripwire: Remove recipe libest: Remove recipe paxctl: Remove recipe packagegroup-core-security: update for recent changes meta-tpm: Small maintainers fix Update kas configuration for poky obsolescence ima-evm-utils: remove unnecessary FILESEXTRAPATHS tweak suricata: update to 7.0.13 scap-security-guide: update branch meta-parsec: Remove meta-clang dependency Update kas configuration lynis: upgrade to 3.1.6 Stephan Wurm (1): dm-verity-img.bbclass: filter units from value part Yi Zhao (10): python3-fail2ban: fix ptest failures python3-fail2ban: update to latest git rev libmhash: fix build with gcc 15 openscap: upgrade 1.4.1 -> 1.4.2 scap-security-guide: upgrade 0.1.77 -> 0.1.78 libgssglue: update HOMEPAGE libgssglue: add UPSTREAM_CHECK_GITTAGREGEX libmhash: add UPSTREAM_CHECK_URI sssd: inherit github-releases class scap-security-guide: add UPSTREAM_CHECK_GITTAGREGEX hongxu (2): ecryptfs-utils: Add CVE tag for ecryptfs-utils-CVE-2016-6224.patch openscap: switch to libpcre2 Change-Id: I3564dc33a6d6d54bb62f7643c673860a8e83e1d0 Signed-off-by: Patrick Williams

meta-security: move to upstream-layers

2026-03-11T21:49:31+00:00

As part of the poky deprecation, use that as an opportunity to move upstream layers into their own subdirectory. This allows us to be clearer as to which layers are owned by the openbmc org and which ones are from upstream. We can then make it more obvious that upstream repositories should be left unchanged. Signed-off-by: Patrick Williams Change-Id: Ia1ec386c5a1eeea541db2d29f622242e958d3ded