BMC/tmp/openbmc.git/meta-security, branch gatesgarth

subtree updates

2021-03-11T20:08:32+00:00

meta-openembedded: 6ff4bd4f34..945f062ff0: Anatol Belski (1): xmlsec1: Fix configure QA error caused by host lookup path Armin Kuster (1): lua: update to 5.3.6 Dmitry Baryshkov (2): xterm: install xterm and uxterm desktop files xterm: provide virtual/x-terminal-emulator Kai Kang (1): mariadb: add package config zstd Khem Raj (7): mariadb: Fix build on 32bit arches with 64bit time_t gedit: Inherit python3targetconfig openipmi: Inherit python3targetconfig libplist: Inherit python3targetconfig postgresql: Inherit python3targetconfig python-grpcio-tools: Add missing space for append python3-pykwalify: Do not unset _PYTHON_SYSCONFIGDATA_NAME Mario Schuknecht (1): dnsmasq: Fix systemd service Martin Jansa (1): wireguard-module: remove PKG assignment Mikko Rapeli (2): flatbuffers: whitelist CVE-2020-35864 giflib: apply patch for CVE-2019-15133 and set CVE_PRODUCT Mingli Yu (1): mariadb: upgrade to 10.5.8 Qi.Chen@windriver.com (1): minifi-cpp: set PSEUDO_CONSIDER_PATHS S. Lockwood-Childs (1): sip3: simplify recipe Shlomi Vaknin (1): python3-sh: remove python3-tests from RDEPENDS Søren Andersen (1): zram: fix sourcing of zram parameters Wang Mingyu (1): dnsmasq: upgrade 2.82 -> 2.84 akuster (2): enca: Fix SRC_URI meta-oe/README: add Ubuntu prerequisite information changqing.li@windriver.com (1): celt051: update SRC_URI zangrc (2): iscsi-initiator-utils: upgrade 2.1.2 -> 2.1.3 openldap: upgrade 2.4.51 -> 2.4.56 zhengruoqin (1): openldap: upgrade 2.4.56 -> 2.4.57 meta-security: 4583ab9b08..3daf99fd13: Armin Kuster (7): .gitlab-ci: drop script apparmor: Inherit python3targetconfig python3-suricata-update: Inherit python3targetconfig openscap: Inherit python3targetconfig scap-security-guide: Inherit python3targetconfig kas-security-base.yml: build setting updates kas-security-base: use gatesgarth name Ming Liu (9): ima-evm-utils: set native REQUIRED_DISTRO_FEATURES to empty initramfs-framework-ima: fix a wrong path ima-evm-keys: add recipe initramfs-framework-ima: RDEPENDS on ima-evm-keys meta: refactor IMA/EVM sign rootfs README.md: update according to the refactoring in ima-evm-rootfs.bbclass initramfs-framework-ima: let ima_enabled return 0 ima-evm-rootfs.bbclass: avoid generating /etc/fstab for wic ima-policy-hashed: add CGROUP2_SUPER_MAGIC fsmagic poky: 9de9e2e319..6ed895d2b2: Alexander Kanavin (6): python3: split python target configuration into own class python3-pycairo: use python3targetconfig distutils3-base.bbclass: use python3targetconfig meta: drop _PYTHON_SYSCONFIGDATA_NAME hacks gpgme: use python3targetconfig bitbake: lib/bb/fetch2/__init__.py: drop _PYTHON_SYSCONFIGDATA_NAME unsetting Andrei Gherzan (1): oe/recipeutils: Fix copying patches when BBLAYERS entries are not normalised Anuj Mittal (8): linux-yocto: update genericx86 to v5.4.87 python3: fix CVE-2021-3177 sudo: fix CVE-2021-23239 gstreamer1.0: fix failing ptest sudo: fix CVE-2021-23240 sudo: fix CVE-2021-3156 documentation: version bumps for 3.2.2 release linux-yocto: update genericx86* to v5.4.94 Awais Belal (1): kernel.bbclass: fix deployment for initramfs images Bruce Ashfield (5): linux-yocto/5.4: update to v5.4.90 linux-yocto-rt/5.4: fix 5.4-stable caused build breakage linux-yocto/5.4: update to v5.4.94 linux-yocto/5.4: update to v5.4.96 linux-yocto/5.4: update to v5.4.98 Chee Yang Lee (1): initrdscripts: init-install-efi.sh install extra files for ESP Chen Qi (1): systemd: change /bin/nologin to /sbin/nologin Dorinda (4): sanity: Verify that user isn't building in PSEUDO_IGNORE_PATHS sanity.bbclass: sanity check for if bitbake is present in PATH sanity.bbclass: Check if PSEUDO_IGNORE_PATHS and paths under pseudo control overlap oe-pkgdata-util: Check if environment script is initialized Florian Bezdeka (1): wic: Warn if an ext filesystem affected by the Y2038 problem is used Jan-Simon Möller (1): package_rpm: Enable use_source_date_epoch_as_buildtime in package_rpm class Joshua Watt (7): libomxil: Fix up commercial license flag weston: remoting backend requires GStreamer base plugins oeqa: reproducible: Fix SSTATE_MIRRORS variable oeqa: reproducible: Add more logging systemd: Re-enable chvt as non-root user without polkit bison: Fix up file name mapping acpica: Fix reproducibility issues Kamel Bouhara (2): npm.bbclass: make shrinkwrap file optional recipetool: create: only add npmsw url if required Khem Raj (4): python3targetconfig.bbclass: Make py3 dep and tasks only for target recipes tcf-agent: Fix build on riscv32 go: Update to 1.15.8 oeqa/pam: Need shadow installed for the tests Lee Chee Yang (11): gdk-pixbuf: fix CVE-2020-29385 p11-kit: upgrade 0.23.21 -> 0.23.22 cve-check: replace Looseversion with custom version class cve_check: add CVE_VERSION_SUFFIX to indicate suffix in versioning openssl: set CVE_VERSION_SUFFIX wic/selftest: test_permissions also test bitbake image wic: debug mode to keep tmp directory qemu: fix CVE-2020-29443 CVE-2020-35517 openssh: fix CVE-2020-14145 python3: fix CVE-2021-23336 libsdl2: fix CVE-2020-14409 CVE-2020-14410 Marek Vasut (1): weston-init: Fix weston-keyboard path in weston.ini Martin Jansa (2): image_types.bbclass: tar: use posix format instead of gnu sstatesig.py: show an error instead of warning when sstate manifest isn't found Matt Hoosier (1): bitbake: fetch/git: download LFS content too during do_fetch Michael Halstead (3): uninative: Upgrade to 2.10 yocto-uninative.inc: version 2.11 updates glibc to 2.33 yocto-uninative.inc: version 3.0 incorporate seccomp filter workaround Mike Crowe (1): externalsrc: Pass through npmsw URIs in SRC_URI Mike Looijmans (1): license_image.bbclass: Don't attempt to symlink to the same file Milan Shah (1): report-error.bbclass: Add layer and bitbake version info to error report Mingli Yu (1): python3: Fix python interpreter line length for nativesdk Minjae Kim (1): bind: fix CVE-2020-8625 Oleksiy Obitotskyy (1): dtc: improve reproducibility Ovidiu Panait (1): timezone: upgrade to 2021a Peter Bergin (1): buildhistory.bbclass: avoid exception for empty BUILDHISTORY_FEATURES variable Peter Kjellerstedt (1): asciidoc: Switch to using the main branch Richard Leitner (1): deb: export INTERCEPT_DIR for remove actions Richard Purdie (45): gobject-introspection: Fix variable override order pseudo: Update to include passwd and file renaming fixes image_types: Ensure tar archives are reproducible ncurses: Don't put terminfo into the sysroot python3: Avoid installing test data into recipe-sysroot staging: Clean up files installed into the sysroot package: Ensure do_packagedata is cleaned correctly qemu.inc: Should depend on qemu-system-native, not qemu-native openssh: Backport a fix to fix with glibc 2.33 on some platforms pseudo: Update to work with glibc 2.33 poky.conf: Bump version for 3.2.2 gatesgarth release build-appliance-image: Update to gatesgarth head revision pseudo: Update for rename and faccessat fixes pseudo: Update to include fixes for glibc 2.33 opkg: Fix build reproducibility issue opkg: Fix patch glitches cwautomacros: Ensure version is set deterministically vim: Improve determinism vim: Fix a race over creation of the desktop files package_manager/deb: Fix image generation with package removal quilt: Be determnistic about column presence buildtools-extended-tarball: Add glibc-gconvs needed for build watchdog: Fix determinism issue from sendmail host path watchdog: Avoid reproducibility failures after fixing build xmlto: Fix reproducibility bitbake: __init__.py: Fix bitbake debug log handling xorg-fonts-minimal: Fix reproducibility xorg-minimal-fonts: Really fix determinism git: Fix determinism issue groff: Fix determinism issue oeqa/commands: Fix compatibility with python 3.9 linux-firmware: upgrade 20201218 -> 20210208 rsync: Fix a file sorting determinism issue rsync: Fix group name determinism issue libevdev: Update patch status to backport babeltrace2: Fix reproducibility cups: Fix reproducibility issues gcr: Fix reproducibility issue epiphany: Fix reproducibility issue epiphany: Fix distributor contamination from /etc/os-release image: Add directories to PSEUDO_IGNORE_PATHS populate_sdk: Add directories to PSEUDO_IGNORE_PATHS bitbake.conf/image: Move image specific PSEUDO_IGNORE_PATHS to image class bitbake.conf: Split PSEUDO_IGNORE_PATHS to be more readable parted: Fix reproducibility issue Ross Burton (3): core-image-sato-sdk-ptest: these images need ptest ovmf-shell-image: image is only buildable on x86-64 rootfs_deb: handle aarch64 SDK_ARCH Scott Murray (1): screen: fix CVE-2021-26937 Stefan Ghinea (2): wpa-supplicant: fix CVE-2021-0326 cups: fix CVE-2020-10001 Steve Sakoman (1): glibc: update to latest release/2.32/master branch Thomas Viehweger (1): mtd-utils: Remove duplicate assignments to alternative link names Tomasz Dziendzielski (7): externalsrc: Fix parsing error with devtool non-git sources devtool: Fix file:// fetcher symlink directory structure externalsrc: Detect code changes in submodules lib/oe/patch.py: Don't return command stderr from runcmd function python3: Use addtask statement instead of task dependencies sstatesig: Add descriptive error message to getpwuid/getgrgid "uid/gid not found" KeyError bitbake.conf: Introduce FAKEROOTLOGS variable used by bitbake to print pseudo.log Vivien Didelot (1): systemd: Fix importd requirements comment Vyacheslav Yurkov (1): npm.bbclass: use python3 for npm config Wang Mingyu (1): openssl: upgrade 1.1.1i -> 1.1.1j Wes Lindauer (1): df.py: Add feature check for read-only-rootfs Yi Fan Yu (4): oeqa/selftest/cases/tinfoil.py: increase timeout 10->60s test_wait_event strace: increase ptest timeout duration 120->240s valgrind: Disable ptest nlcontrolc for x86-64 valgrind: Increase timeout duration 30 -> 90 s Yoann Congal (1): npm.bbclass: avoid building target nodejs for native npm recipes Zbigniew Bodek (1): wpebackend-fdo: Fix missing .so symlink when using dev package akuster (3): connman: update to 1.39 cve-check.bbclass: add layer to cve log cve-check: add include/exclude layers saloni (2): libgcrypt: Whitelisted CVEs libcroco: Added CVE zhengruoqin (1): ca-certificates: upgrade 20200601 -> 20210119 Signed-off-by: Patrick Williams Change-Id: Ia7dc0d8b97be9ce10af73a6c8af4e176a538fe1c

create gatesgarth branch

2020-12-08T19:32:35+00:00

Reset the following subtrees on gatesgarth: meta-raspberrypi: 09a3c11696(gatesgarth) poky: 943ef2fad8(gatesgarth) meta-openembedded: b9dcf17700(gatesgarth) meta-xilinx: b3e37df5d9(gatesgarth) meta-security: 4583ab9b08(gatesgarth) cherry pick: meta-phosphor: c52fa217b832 Change-Id: I8ad417df218284605f6edfe65798a3b0c99aba12 Signed-off-by: Brad Bishop

meta-security: subtree update:e8c9e69c80..d2ceb5e438

2020-12-01T01:54:57+00:00

Armin Kuster (2): samhain: update to 4.4.2 kas-security-base: Don't create local SSTATE mirror Yi Zhao (3): suricata: unify volatiles file name clamav: unify volatiles file name scap-security-guide: fix build with Python 3.9 Signed-off-by: Andrew Geissler Change-Id: I60c6ba8c22593542165dbd1af0606e01f6473b33

meta-security: subtree update:4c2f7ffd49..e8c9e69c80

2020-10-30T20:42:06+00:00

Armin Kuster (3): meta-security: Add gatesgarth to LAYERSERIES_COMPAT gitlab-ci: add meta-hardening build image gitlab-ci: add building meta-security-compliance pkgs Sajjad Ahmed (1): layer.conf: use += instead of := to update BBFILES Signed-off-by: Andrew Geissler Change-Id: Id5439f3fdfc88fe3c987ee3c8cb7d3ed6a5a6a22

meta-security: subtree update:d6baccc068..4c2f7ffd49

2020-10-16T15:14:41+00:00

Adrian (1): gitignore added Armin Kuster (31): kas: build with ptest. remove apparmor softHSM: add pkg packagegroup-core-security: add softHSM libest: add recipe packagegroup-core-security: add libest package opendnssec: add recipe packagegroup-core-security: add opendnssec to pkg grp gitlab-ci: allow test to fail libseccomp: fix ptest failures. packagegroup-core-security-ptest: remove keyutils-ptest security-test-image: simplify packagegroup-core-security-ptest: remove apparmor: fix build issue with ptest enabled. security-test-image: tweak to get more tests to runn apparmor: update to 3.0 packagegroup-core-security: apparmor 3.0 ptest does not build suricata: fix compiling on gcc10 qemux86-test: add apparmor back apparmor: fix build for on musl ecryptfs-utils: fix musl build libest: fix musl build. sssd: update to latest ltm 1.16.5 packagegroup-core-security: remove clamav from musl image suricata: update to 4.1.9 kas: fixup alt configs gitlab-ci: add qemux86 and qemuarm64 musl builds tpm2-tss: update to 2.4.3 tpm2-totp: update to 0.2.1 tpm2-abrmd: update to 2.3.3 tpm2-tools: update to 4.3.0 tpm2-pkcs11: update to 1.4.0 Mingli Yu (1): scap-security-guide: add expat-native to DEPENDS Naveen Saini (3): initramfs-framework/dmverity: add retry loop for slow boot devices wic: add wks.in for intel dm-verity linux-%/5.x: Add dm-verity fragment as needed Signed-off-by: Andrew Geissler Change-Id: If3a721fdd99bb6e35c82cf4e7485f06cebaef905

meta-security: subtree update:787ba6faea..d6baccc068

2020-09-18T18:34:49+00:00

Armin Kuster (20): trousers: update to tip upload-error-report: add script to upload errors kas/kas-security-base.yml: lets enable error reporting .gitlab: send error reports cryptsetup-tpm-incubator: drop recipe sssd: Avoid nss function conflicts with glibc nss.h cryptsetup-tpm-incubator: remove reference from other files packagegroup-core-security: dont include suricata on riscv or ppc kas-security-base: add testimage kas: add test config kas: add one dm-verify image build gitlab-ci: add dm-verify-image gitlab-ci: add testimage meta-harden: Add a layer to demo harding OE/YP kas-security-base: define sections as base packagegroup-core-security: add more pkgs to base group apparmor: exclude mips64, not supported kas: add alt and mutli build images kas-security-base: set RPM and disable ptest qemu test: set ptest Charlie Davies (1): clamav: update SO_VER to 9.0.4 Jens Rehsack (2): ibmswtpm2: update to 1637 ibmtpm2tss: add recipe Jonatan Pålsson (1): sssd: Make manpages buildable Qi.Chen@windriver.com (1): nss: update patch to fix do_patch error Zheng Ruoqin (1): trousers: Fix the problem that do_package fails when multilib is enabled. niko.mauno@vaisala.com (12): dm-verity-img.bbclass: Fix bashisms dm-verity-img.bbclass: Reorder parse-time check dm-verity-image-initramfs: Ensure verity hash sync dm-verity-image-initramfs: Bind at do_image instead linux-yocto(-dev): Add dm-verity fragment as needed dm-verity-img.bbclass: Stage verity.env file initramfs-framework: Add dmverity module dm-verity-image-initramfs: Use initramfs-framework dm-verity-initramfs-image: Cosmetic improvements dm-verity-image-initramfs: Add base-passwd package dm-verity-image-initramfs: Drop locales from image beaglebone-yocto-verity.wks.in: Refer IMGDEPLOYDIR Signed-off-by: Andrew Geissler Change-Id: I9f2debc1f48092734569fd106b56cd7bcb6180b7

meta-security: subtree update:066a04425c..787ba6faea

2020-08-21T20:57:24+00:00

Armin Kuster (10): lynis: update to 3.0.0 security images: Move to recipe-core security packagegroups: move to recipes-core packagegroup-security-tpm: add more packages for building packagegroup-core-security: remove clamav for riscv* libsecomp: rv32/rv64 target builds are not supported yet packagegroup-core-security: remove libseccomp for riscv* libseccomp: update to 2.5.0 packagegroup-core-security: restore riscv64 for libssecomp trousers: Several Security fixes Charlie Davies (1): clamav: add INSTALL_CLAMAV_CVD flag to do_install Kai Kang (1): libseccomp: fix cross compile error for mips Yi Zhao (1): ibmswtpm2: upgrade 1563 -> 1628 Signed-off-by: Andrew Geissler Change-Id: I0341c0d4cd61fb6ef7db6a29f9fc60de3caa822f

meta-security: subtree update:547f552c85..066a04425c

2020-07-24T21:10:27+00:00

Armin Kuster (9): python3-oauth2client: add recipe python3-privacyidea: adding initial support for mfa strongswan: add bbappends for tpm changes layer.conf: add dynamic-layer for strongswan strongswan: Add bbappends for ima changes meta-integrity: add dynamic-layer for strongswan add gitlab framework and qemu machine kas: add ima, tpm and tpm2 build configs drop ci-build: it is hiding errors Jeremy Puhlman (2): cryptsetup-tpm-incubator: RPROVIDES cryptsetup and cryptsetup-dev packagegroup-security-tpm2: Depend on preferred provider for cryptsetup Zheng Ruoqin (2): ccs-tools:Fix build error when enable multilib. bastille: Deleted redundant inherit to fix error when enable multilib. Signed-off-by: Andrew Geissler Change-Id: I023e45c8080c3d423cd25cc656da5c1f527295e5

meta-security: subtree update:7831969f8c..547f552c85

2020-07-10T20:55:26+00:00

Armin Kuster (3): suricata: update to 4.1.8 packagegroup-core-security-ptest: update fail2ban ptest pkg name isafw.bbclass: typo in layer name Signed-off-by: Andrew Geissler Change-Id: I1a4a51839d53d75ca7e45ea7b1fdb46a62fe33b9

meta-security: subtree update:95fe86eb98..7831969f8c

2020-06-27T05:15:04+00:00

Alexander Kanavin (1): apparmor: pull in coreutils/findutils only when not using systemd as init manager Armin Kuster (7): tpm2-tools: update to 4.1.3 tpm2-tss: update to 2.4.1 tpm2-tss-engine: add branch to SRC_URI & update to tip tpm2-pkcs11: update 1.2.0 libtpm: update to 0.7.2 openscap: update to 1.3.3 tpm2-tcti-uefi: drop patch no longer needed Jeremy Puhlman (2): clamav: resolve multilib issues tripwire: Remove makefiles from the man directories. Kai Kang (1): sssd: disable build secrets Signed-off-by: Andrew Geissler Change-Id: I1e19d2563541504bcf89f1f70c680bd7e7e62d6c