subtree updates

meta-security: de6712a806..a85fbe980e:
  Anton Antonov (1):
        Upgrade parsec-service 0.8.1 and parsec-tool 0.4.0

  Armin Kuster (1):
        chkrootkit: update to 0.55

  Bhupesh Sharma (1):
        recipes-security/fscrypt: Add fscrypt .bb file

  Christer Fletcher (1):
        dmverity: Make use of DATA_BLOCK_SIZE variable in initrdscript.

  Kristian Klausen (1):
        libtpm: update to 0.8.7

  Zoltán Böszörményi (1):
        clamav: Set clamav:clamav ownership on /var/lib/clamav in do_install

poky: 06dcace68b..80f2b56ad8:
  Anibal Limon (1):
        recipes-support/ptest-runner: Bump to v2.4.2

  Bruce Ashfield (5):
        linux-yocto-dev: update to v5.15-rcX
        lttng-modules/dev-upstream: update to 2.13-latest
        lttng-modules: fix build against 5.15+
        linux-yocto/5.13: drop recipes
        yocto-bsp/5.13: drop recipes

  Chandana kalluri (1):
        scriptutils.py: Add check before deleting path

  Daniel Wagenknecht (2):
        common-tasks: add note about license implications of bundled initramfs
        ref-manual: add note about license implications of bundled initramfs

  Joshua Watt (2):
        lib/oe/spdx.py: Add comments
        python3: Fix sysroot reproducibility

  Kenfe-Mickael Laventure (1):
        package_ipk: Use localdata store when signing packages

  Kiran Surendran (1):
        ffmpeg: fix CVE-2021-38171

  Kristian Klausen (2):
        ovmf: add TPM PACKAGECONFIG and enable if tpm is in MACHINE_FEATURES
        wic/bootimg-efi: Add Unified Kernel Image option

  Markus Volk (1):
        wic:direct.py: ignore invalid mountpoints during fstab update

  Matt Madison (1):
        autotools.bbclass: use ordinary append for file-checksums update

  Michael Halstead (1):
        releases: update to include 3.1.11

  Minjae Kim (1):
        vim: fix CVE-2021-3778

  Quentin Schulz (1):
        ref-manual: fix missed override syntax change

  Rasmus Villemoes (1):
        kernel.bbclass: remove unnecessary dead code

  Richard Purdie (29):
        oeqa/qemurunner: Use oe._exit(), not sys.exit()
        pseudo: Add in ability to flush database with shutdown request
        packagegroup-core-tools-profile: Exclude systemtap from riscv32 as well
        bitbake: bitbake-worker: Allow shutdown/database flush of pseudo server at task exit
        bitbake: siggen: Fix sorting in diff output
        bitbake: cooker/command: Add a dummy event for tinfoil testing
        oeqa/selftest/gotoolchain: Fix temp file cleanup
        oeqa/buildproject: Ensure temp directories are cleaned up
        libc_package/buildstats: Fix python regex quoting warnings
        oeqa/selftest/tinfoil: Update to use test command
        glew: Stop polluting /tmp during builds
        rpm: Ensure compression parallelism isn't coded into rpms
        package: Ensure pclist files are deterministic and don't use full paths
        gnupg: Be deterministic about sendmail
        mesa: Ensure megadrivers runtime mappings are deterministic
        util-linux: Fix reproducibility
        libtool: Allow libtool-cross to reproduce
        gobject-introspection: Don't write $HOME into scripts
        oeqa/selftest/bbtests: Add uuid to force build test
        image: Exclude IMAGE_VERSION_SUFFIX from expansion in image tasks
        sstatesig: Revert "Test cross/native hashserv method extension"
        bitbake: data: Ensure functions are defined in a deterministic order
        bitbake.conf: Set vardepvalue for PARALLEL_MAKEINST
        externalsrc: Fix a source date epoch race in reproducible builds
        sstatesig: Add processing for full build paths in sysroot files
        python3: Drop broken pyc files
        image-artifact-names: Use SOURCE_DATE_EPOCH when making reproducible builds for deploy
        abi_version/sstate: Bump HASH_VERSION and SSTATE_VERSION
        reproducible_build: Work around caching issues

  Robert P. J. Day (3):
        ref-manual: extend explanation of PACKAGE_DEBUG_SPLIT_STYLE
        ref-manual: mention INHIBIT_PACKAGE_DEBUG_SPLIT variable
        overview-manual: delete bad backslashes in SSTATE_MIRRORS example

  Saul Wold (3):
        spdx-licenses.json: Use 3.14 tagged version
        spdx.py: Add SPDXAnnotation Object
        create-spdx: Use SPDXAnnotation to track native recipes

  Thomas Perrot (2):
        libevent: mark util/monotonic_prc_fallback as retriable
        ruby: fix the reproducibility issue

  Tom Pollard (2):
        bzip2: Update soname for libbz2 1.0.8
        libsamplerate0: Set correct soname for 0.1.9

  Trevor Woerner (1):
        hello-mod/hello.c: convert printk to pr_xxx

  William A. Kennington III (1):
        rm_work.bbclass: Fix for files starting with -

  Yi Zhao (1):
        inetutils: fix CVE-2021-40491

  wangmy (1):
        strace: upgrade 5.13 -> 5.14

meta-openembedded: cff8331f96..23dc4f060f:
  Armin Kuster (1):
        README: update to main repo

  Chandana kalluri (1):
        python3-humanfriendly: Add nativesdk to BBCLASSEXTEND

  Changqing Li (1):
        layer.conf: add openembedded-layer as LAYERDEPENDS

  Khem Raj (3):
        smcroute: Add missing pkgconfig inherit
        packagegroup-meta-oe: Add new packages smarty and libjs-jquery-icheck
        gattlib: Upgrade to latest

  LiweiSong (1):
        chipsec: platform security assessment framework

  Martin Jansa (5):
        opencv: fix build with protobuf-3.18 when dnn PACKAGECONFIG is enabled
        libeigen: backport fix for -Werror=class-memaccess issues when NEON is enabled
        README: mention linux-libc-dev:i386 for luajit on ubuntu-21.10
        gpsd: inherit pkgconfig
        pahole: use MACHINE_ARCH

  Matteo Croce (1):
        pahole: don't download vendored libbpf

  Mingli Yu (1):
        libqb: Upgrade to 2.0.3

  Nandor Han (1):
        libiio: depend on avahi only when network backed is used

  Peter Kjellerstedt (1):
        netdata: Move the version to the file name and correct the SRC_URI

  Richard Purdie (1):
        gattlib: Place pkgconfig file in correct package

  Yi Zhao (1):
        phpmyadmin: upgrade 5.1.0 -> 5.1.1

  wangmy (7):
        unionfs-fuse: upgrade 2.1 -> 2.2
        smcroute: upgrade 2.4.4 -> 2.5.3
        snort: upgrade 2.9.18 -> 2.9.18.1
        libsass: upgrade 3.6.4 -> 3.6.5
        sanlock: upgrade 3.8.3 -> 3.8.4
        sassc: upgrade 3.6.1 -> 3.6.2
        valijson: upgrade 0.5 -> 0.6

  zangrc (8):
        python3-pychromecast: upgrade 9.2.0 -> 9.2.1
        python3-pyro4: upgrade 4.80 -> 4.81
        python3-pyzmq: upgrade 22.2.1 -> 22.3.0
        python3-robotframework: upgrade 4.1 -> 4.1.1
        python3-sqlparse: upgrade 0.4.1 -> 0.4.2
        python3-tqdm: upgrade 4.62.2 -> 4.62.3
        libjs-jquery-icheck: Add recipe
        smarty: Add recipe

  zhengruoqin (6):
        python3-cmd2: upgrade 2.1.2 -> 2.2.0
        python3-huey: upgrade 2.4.0 -> 2.4.1
        python3-humanfriendly: upgrade 9.2 -> 10.0
        cifs-utils: upgrade 6.13 -> 6.14
        cmark: upgrade 0.30.1 -> 0.30.2
        gpsd: upgrade 3.23 -> 3.23.1

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Change-Id: Ie782ff5d7f3004fb1f1ac9a4c8644a178bae46ad

13 files changed, 68 insertions, 47 deletions

diff --git a/poky/meta/classes/autotools.bbclass b/poky/meta/classes/autotools.bbclass
index bc0c2ea83..4ab246099 100644
--- a/poky/meta/classes/autotools.bbclass
+++ b/poky/meta/classes/autotools.bbclass
@@ -149,10 +149,7 @@ python autotools_aclocals () {
     d.setVar("CONFIG_SITE", " ".join(sitefiles))
 }
 
-python () {
-    sitefiles, searched = siteinfo_get_files(d, sysrootcache=False)
-    d.appendVarFlag("do_configure", "file-checksums", " " + " ".join(searched))
-}
+do_configure[file-checksums] += "${@' '.join(siteinfo_get_files(d, sysrootcache=False)[1])}"
 
 CONFIGURE_FILES = "${S}/configure.in ${S}/configure.ac ${S}/config.h.in ${S}/acinclude.m4 Makefile.am"
 
diff --git a/poky/meta/classes/create-spdx.bbclass b/poky/meta/classes/create-spdx.bbclass
index 3c73c21c0..739b46e9b 100644
--- a/poky/meta/classes/create-spdx.bbclass
+++ b/poky/meta/classes/create-spdx.bbclass
@@ -13,6 +13,9 @@ SPDXDIR ??= "${WORKDIR}/spdx"
 SPDXDEPLOY = "${SPDXDIR}/deploy"
 SPDXWORK = "${SPDXDIR}/work"
 
+SPDX_TOOL_NAME ??= "oe-spdx-creator"
+SPDX_TOOL_VERSION ??= "1.0"
+
 SPDXRUNTIMEDEPLOY = "${SPDXDIR}/runtime-deploy"
 
 SPDX_INCLUDE_SOURCES ??= "0"
@@ -32,6 +35,10 @@ def get_doc_namespace(d, doc):
     namespace_uuid = uuid.uuid5(uuid.NAMESPACE_DNS, d.getVar("SPDX_UUID_NAMESPACE"))
     return "%s/%s-%s" % (d.getVar("SPDX_NAMESPACE_PREFIX"), doc.name, str(uuid.uuid5(namespace_uuid, doc.name)))
 
+def recipe_spdx_is_native(d, recipe):
+    return any(a.annotationType == "OTHER" and
+      a.annotator == "Tool: %s - %s" % (d.getVar("SPDX_TOOL_NAME"), d.getVar("SPDX_TOOL_VERSION")) and
+      a.comment == "isNative" for a in recipe.annotations)
 
 def is_work_shared(d):
     pn = d.getVar('PN')
@@ -336,6 +343,10 @@ def collect_dep_sources(d, dep_recipes):
 
     sources = {}
     for dep in dep_recipes:
+        # Don't collect sources from native recipes as they
+        # match non-native sources also.
+        if recipe_spdx_is_native(d, dep.recipe):
+            continue
         recipe_files = set(dep.recipe.hasFiles)
 
         for spdx_file in dep.doc.files:
@@ -382,7 +393,6 @@ python do_create_spdx() {
     include_sources = d.getVar("SPDX_INCLUDE_SOURCES") == "1"
     archive_sources = d.getVar("SPDX_ARCHIVE_SOURCES") == "1"
     archive_packaged = d.getVar("SPDX_ARCHIVE_PACKAGED") == "1"
-    is_native = bb.data.inherits_class("native", d)
 
     creation_time = datetime.now(tz=timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
@@ -401,6 +411,13 @@ python do_create_spdx() {
     recipe.name = d.getVar("PN")
     recipe.versionInfo = d.getVar("PV")
     recipe.SPDXID = oe.sbom.get_recipe_spdxid(d)
+    if bb.data.inherits_class("native", d):
+        annotation = oe.spdx.SPDXAnnotation()
+        annotation.annotationDate = creation_time
+        annotation.annotationType = "OTHER"
+        annotation.annotator = "Tool: %s - %s" % (d.getVar("SPDX_TOOL_NAME"), d.getVar("SPDX_TOOL_VERSION"))
+        annotation.comment = "isNative"
+        recipe.annotations.append(annotation)
 
     for s in d.getVar('SRC_URI').split():
         if not s.startswith("file://"):
@@ -480,7 +497,7 @@ python do_create_spdx() {
     sources = collect_dep_sources(d, dep_recipes)
     found_licenses = {license.name:recipe_ref.externalDocumentId + ":" + license.licenseId for license in doc.hasExtractedLicensingInfos}
 
-    if not is_native:
+    if not recipe_spdx_is_native(d, recipe):
         bb.build.exec_func("read_subpackage_metadata", d)
 
         pkgdest = Path(d.getVar("PKGDEST"))
diff --git a/poky/meta/classes/externalsrc.bbclass b/poky/meta/classes/externalsrc.bbclass
index 7f1a760ee..ad93b2d2a 100644
--- a/poky/meta/classes/externalsrc.bbclass
+++ b/poky/meta/classes/externalsrc.bbclass
@@ -109,16 +109,15 @@ python () {
             if local_srcuri and task in fetch_tasks:
                 continue
             bb.build.deltask(task, d)
-
-        if bb.data.inherits_class('reproducible_build', d) and 'do_unpack' in d.getVar("SRCTREECOVEREDTASKS").split():
-            # The reproducible_build's create_source_date_epoch_stamp function must
-            # be run after the source is available and before the
-            # do_deploy_source_date_epoch task.  In the normal case, it's attached
-            # to do_unpack as a postfuncs, but since we removed do_unpack (above)
-            # we need to move the function elsewhere.  The easiest thing to do is
-            # move it into the prefuncs of the do_deploy_source_date_epoch task.
-            # This is safe, as externalsrc runs with the source already unpacked.
-            d.prependVarFlag('do_deploy_source_date_epoch', 'prefuncs', 'create_source_date_epoch_stamp ')
+            if bb.data.inherits_class('reproducible_build', d) and task == 'do_unpack':
+                # The reproducible_build's create_source_date_epoch_stamp function must
+                # be run after the source is available and before the
+                # do_deploy_source_date_epoch task.  In the normal case, it's attached
+                # to do_unpack as a postfuncs, but since we removed do_unpack (above)
+                # we need to move the function elsewhere.  The easiest thing to do is
+                # move it into the prefuncs of the do_deploy_source_date_epoch task.
+                # This is safe, as externalsrc runs with the source already unpacked.
+                d.prependVarFlag('do_deploy_source_date_epoch', 'prefuncs', 'create_source_date_epoch_stamp ')
 
         d.prependVarFlag('do_compile', 'prefuncs', "externalsrc_compile_prefunc ")
         d.prependVarFlag('do_configure', 'prefuncs', "externalsrc_configure_prefunc ")
diff --git a/poky/meta/classes/image-artifact-names.bbclass b/poky/meta/classes/image-artifact-names.bbclass
index 3ac8dd731..67f04e816 100644
--- a/poky/meta/classes/image-artifact-names.bbclass
+++ b/poky/meta/classes/image-artifact-names.bbclass
@@ -4,7 +4,7 @@
 
 IMAGE_BASENAME ?= "${PN}"
 IMAGE_VERSION_SUFFIX ?= "-${DATETIME}"
-IMAGE_VERSION_SUFFIX[vardepsexclude] += "DATETIME"
+IMAGE_VERSION_SUFFIX[vardepsexclude] += "DATETIME SOURCE_DATE_EPOCH"
 IMAGE_NAME ?= "${IMAGE_BASENAME}-${MACHINE}${IMAGE_VERSION_SUFFIX}"
 IMAGE_LINK_NAME ?= "${IMAGE_BASENAME}-${MACHINE}"
 
@@ -13,3 +13,10 @@ IMAGE_LINK_NAME ?= "${IMAGE_BASENAME}-${MACHINE}"
 # by default) followed by additional suffices which describe the format (.ext4,
 # .ext4.xz, etc.).
 IMAGE_NAME_SUFFIX ??= ".rootfs"
+
+python () {
+    if bb.data.inherits_class('reproducible_build', d) and bb.data.inherits_class('deploy', d) and d.getVar("IMAGE_VERSION_SUFFIX") == "-${DATETIME}":
+        import datetime
+        d.setVar("IMAGE_VERSION_SUFFIX", "-" + datetime.datetime.fromtimestamp(int(d.getVar("SOURCE_DATE_EPOCH")), datetime.timezone.utc).strftime('%Y%m%d%H%M%S'))
+        d.setVarFlag("IMAGE_VERSION_SUFFIX", "vardepvalue", "")
+}
diff --git a/poky/meta/classes/image.bbclass b/poky/meta/classes/image.bbclass
index 1d88ccd81..c2f323202 100644
--- a/poky/meta/classes/image.bbclass
+++ b/poky/meta/classes/image.bbclass
@@ -434,6 +434,7 @@ python () {
         localdata.delVar('DATETIME')
         localdata.delVar('DATE')
         localdata.delVar('TMPDIR')
+        localdata.delVar('IMAGE_VERSION_SUFFIX')
         vardepsexclude = (d.getVarFlag('IMAGE_CMD:' + realt, 'vardepsexclude', True) or '').split()
         for dep in vardepsexclude:
             localdata.delVar(dep)
diff --git a/poky/meta/classes/image_types_wic.bbclass b/poky/meta/classes/image_types_wic.bbclass
index d561fb263..e3863c88a 100644
--- a/poky/meta/classes/image_types_wic.bbclass
+++ b/poky/meta/classes/image_types_wic.bbclass
@@ -27,6 +27,7 @@ WICVARS ?= "\
 	ROOTFS_SIZE \
 	STAGING_DATADIR \
 	STAGING_DIR \
+	STAGING_DIR_HOST \
 	STAGING_LIBDIR \
 	TARGET_SYS \
 "
@@ -84,8 +85,8 @@ do_image_wic[deptask] += "do_image_complete"
 WKS_FILE_DEPENDS_DEFAULT = '${@bb.utils.contains_any("BUILD_ARCH", [ 'x86_64', 'i686' ], "syslinux-native", "",d)}'
 WKS_FILE_DEPENDS_DEFAULT += "bmap-tools-native cdrtools-native btrfs-tools-native squashfs-tools-native e2fsprogs-native"
 WKS_FILE_DEPENDS_BOOTLOADERS = ""
-WKS_FILE_DEPENDS_BOOTLOADERS:x86 = "syslinux grub-efi systemd-boot"
-WKS_FILE_DEPENDS_BOOTLOADERS:x86-64 = "syslinux grub-efi systemd-boot"
+WKS_FILE_DEPENDS_BOOTLOADERS:x86 = "syslinux grub-efi systemd-boot os-release"
+WKS_FILE_DEPENDS_BOOTLOADERS:x86-64 = "syslinux grub-efi systemd-boot os-release"
 WKS_FILE_DEPENDS_BOOTLOADERS:x86-x32 = "syslinux grub-efi"
 
 WKS_FILE_DEPENDS ??= "${WKS_FILE_DEPENDS_DEFAULT} ${WKS_FILE_DEPENDS_BOOTLOADERS}"
diff --git a/poky/meta/classes/kernel.bbclass b/poky/meta/classes/kernel.bbclass
index d13c38fb0..4acec1877 100644
--- a/poky/meta/classes/kernel.bbclass
+++ b/poky/meta/classes/kernel.bbclass
@@ -322,15 +322,6 @@ python do_devshell:prepend () {
 
 addtask bundle_initramfs after do_install before do_deploy
 
-get_cc_option () {
-		# Check if KERNEL_CC supports the option "file-prefix-map".
-		# This option allows us to build images with __FILE__ values that do not
-		# contain the host build path.
-		if ${KERNEL_CC} -Q --help=joined | grep -q "\-ffile-prefix-map=<old=new>"; then
-			echo "-ffile-prefix-map=${S}=/kernel-source/"
-		fi
-}
-
 kernel_do_compile() {
 	unset CFLAGS CPPFLAGS CXXFLAGS LDFLAGS MACHINE
 	if [ "${BUILD_REPRODUCIBLE_BINARIES}" = "1" ]; then
@@ -361,9 +352,8 @@ kernel_do_compile() {
 		copy_initramfs
 		use_alternate_initrd=CONFIG_INITRAMFS_SOURCE=${B}/usr/${INITRAMFS_IMAGE_NAME}.cpio
 	fi
-	cc_extra=$(get_cc_option)
 	for typeformake in ${KERNEL_IMAGETYPE_FOR_MAKE} ; do
-		oe_runmake ${typeformake} CC="${KERNEL_CC} $cc_extra " LD="${KERNEL_LD}" ${KERNEL_EXTRA_ARGS} $use_alternate_initrd
+		oe_runmake ${typeformake} CC="${KERNEL_CC}" LD="${KERNEL_LD}" ${KERNEL_EXTRA_ARGS} $use_alternate_initrd
 	done
 	# vmlinux.gz is not built by kernel
 	if (echo "${KERNEL_IMAGETYPES}" | grep -wq "vmlinux\.gz"); then
@@ -390,8 +380,7 @@ do_compile_kernelmodules() {
 		bbnote "KBUILD_BUILD_TIMESTAMP: $ts"
 	fi
 	if (grep -q -i -e '^CONFIG_MODULES=y$' ${B}/.config); then
-		cc_extra=$(get_cc_option)
-		oe_runmake -C ${B} ${PARALLEL_MAKE} modules CC="${KERNEL_CC} $cc_extra " LD="${KERNEL_LD}" ${KERNEL_EXTRA_ARGS}
+		oe_runmake -C ${B} ${PARALLEL_MAKE} modules CC="${KERNEL_CC}" LD="${KERNEL_LD}" ${KERNEL_EXTRA_ARGS}
 
 		# Module.symvers gets updated during the 
 		# building of the kernel modules. We need to
diff --git a/poky/meta/classes/libc-package.bbclass b/poky/meta/classes/libc-package.bbclass
index 7a661d44b..13ef8cdc0 100644
--- a/poky/meta/classes/libc-package.bbclass
+++ b/poky/meta/classes/libc-package.bbclass
@@ -355,7 +355,7 @@ python package_do_split_gconvs () {
                 m.write("\t@echo 'Progress %d/%d'\n" % (i, total))
                 m.write("\t" + makerecipe + "\n\n")
         d.setVar("EXTRA_OEMAKE", "-C %s ${PARALLEL_MAKE}" % (os.path.dirname(makefile)))
-        d.setVarFlag("oe_runmake", "progress", "outof:Progress\s(\d+)/(\d+)")
+        d.setVarFlag("oe_runmake", "progress", r"outof:Progress\s(\d+)/(\d+)")
         bb.note("Executing binary locale generation makefile")
         bb.build.exec_func("oe_runmake", d)
         bb.note("collecting binary locales from locale tree")
diff --git a/poky/meta/classes/package.bbclass b/poky/meta/classes/package.bbclass
index 460997ad5..985dfacd0 100644
--- a/poky/meta/classes/package.bbclass
+++ b/poky/meta/classes/package.bbclass
@@ -2112,12 +2112,12 @@ python package_do_pkgconfig () {
     for pkg in packages.split():
         pkgconfig_provided[pkg] = []
         pkgconfig_needed[pkg] = []
-        for file in pkgfiles[pkg]:
+        for file in sorted(pkgfiles[pkg]):
                 m = pc_re.match(file)
                 if m:
                     pd = bb.data.init()
                     name = m.group(1)
-                    pkgconfig_provided[pkg].append(name)
+                    pkgconfig_provided[pkg].append(os.path.basename(name))
                     if not os.access(file, os.R_OK):
                         continue
                     with open(file, 'r') as f:
@@ -2140,7 +2140,7 @@ python package_do_pkgconfig () {
         pkgs_file = os.path.join(shlibswork_dir, pkg + ".pclist")
         if pkgconfig_provided[pkg] != []:
             with open(pkgs_file, 'w') as f:
-                for p in pkgconfig_provided[pkg]:
+                for p in sorted(pkgconfig_provided[pkg]):
                     f.write('%s\n' % p)
 
     # Go from least to most specific since the last one found wins
diff --git a/poky/meta/classes/package_ipk.bbclass b/poky/meta/classes/package_ipk.bbclass
index 4fcb25ca7..776fe8ed2 100644
--- a/poky/meta/classes/package_ipk.bbclass
+++ b/poky/meta/classes/package_ipk.bbclass
@@ -230,8 +230,8 @@ def ipk_write_pkg(pkg, d):
                                 shell=True)
 
         if d.getVar('IPK_SIGN_PACKAGES') == '1':
-            ipkver = "%s-%s" % (d.getVar('PKGV'), d.getVar('PKGR'))
-            ipk_to_sign = "%s/%s_%s_%s.ipk" % (pkgoutdir, pkgname, ipkver, d.getVar('PACKAGE_ARCH'))
+            ipkver = "%s-%s" % (localdata.getVar('PKGV'), localdata.getVar('PKGR'))
+            ipk_to_sign = "%s/%s_%s_%s.ipk" % (pkgoutdir, pkgname, ipkver, localdata.getVar('PACKAGE_ARCH'))
             sign_ipk(d, ipk_to_sign)
 
     finally:
diff --git a/poky/meta/classes/reproducible_build.bbclass b/poky/meta/classes/reproducible_build.bbclass
index 89f645b85..7571c116c 100644
--- a/poky/meta/classes/reproducible_build.bbclass
+++ b/poky/meta/classes/reproducible_build.bbclass
@@ -115,11 +115,14 @@ EPOCHTASK = "do_deploy_source_date_epoch"
 do_unpack[postfuncs] += "create_source_date_epoch_stamp"
 
 def get_source_date_epoch_value(d):
-    cached = d.getVar('__CACHED_SOURCE_DATE_EPOCH')
-    if cached:
+    epochfile = d.getVar('SDE_FILE')
+    cached, efile = d.getVar('__CACHED_SOURCE_DATE_EPOCH') or (None, None)
+    if cached and efile == epochfile:
         return cached
 
-    epochfile = d.getVar('SDE_FILE')
+    if cached and epochfile != efile:
+        bb.debug(1, "Epoch file changed from %s to %s" % (efile, epochfile))
+
     source_date_epoch = int(d.getVar('SOURCE_DATE_EPOCH_FALLBACK'))
     try:
         with open(epochfile, 'r') as f:
@@ -137,7 +140,7 @@ def get_source_date_epoch_value(d):
     except FileNotFoundError:
         bb.debug(1, "Cannot find %s. SOURCE_DATE_EPOCH will default to %d" % (epochfile, source_date_epoch))
 
-    d.setVar('__CACHED_SOURCE_DATE_EPOCH', str(source_date_epoch))
+    d.setVar('__CACHED_SOURCE_DATE_EPOCH', (str(source_date_epoch), epochfile))
     return str(source_date_epoch)
 
 export SOURCE_DATE_EPOCH ?= "${@get_source_date_epoch_value(d)}"
diff --git a/poky/meta/classes/rm_work.bbclass b/poky/meta/classes/rm_work.bbclass
index 07901d759..5f12d5aae 100644
--- a/poky/meta/classes/rm_work.bbclass
+++ b/poky/meta/classes/rm_work.bbclass
@@ -73,7 +73,7 @@ do_rm_work () {
             # sstate version since otherwise we'd need to leave 'plaindirs' around
             # such as 'packages' and 'packages-split' and these can be large. No end
             # of chain tasks depend directly on do_package anymore.
-            rm -f $i;
+            rm -f -- $i;
             ;;
         *_setscene*)
             # Skip stamps which are already setscene versions
@@ -90,7 +90,7 @@ do_rm_work () {
                     ;;
                 esac
             done
-            rm -f $i
+            rm -f -- $i
         esac
     done
 
@@ -100,9 +100,9 @@ do_rm_work () {
         # Retain only logs and other files in temp, safely ignore
         # failures of removing pseudo folers on NFS2/3 server.
         if [ $dir = 'pseudo' ]; then
-            rm -rf $dir 2> /dev/null || true
+            rm -rf -- $dir 2> /dev/null || true
         elif ! echo "$excludes" | grep -q -w "$dir"; then
-            rm -rf $dir
+            rm -rf -- $dir
         fi
     done
 }
diff --git a/poky/meta/classes/sstate.bbclass b/poky/meta/classes/sstate.bbclass
index 92a73114b..7f4b1f680 100644
--- a/poky/meta/classes/sstate.bbclass
+++ b/poky/meta/classes/sstate.bbclass
@@ -1,4 +1,4 @@
-SSTATE_VERSION = "3"
+SSTATE_VERSION = "5"
 
 SSTATE_MANIFESTS ?= "${TMPDIR}/sstate-control"
 SSTATE_MANFILEPREFIX = "${SSTATE_MANIFESTS}/manifest-${SSTATE_MANMACH}-${PN}"
@@ -67,6 +67,13 @@ SSTATE_DUPWHITELIST += "${DEPLOY_DIR_IMAGE}/microcode"
 SSTATE_SCAN_FILES ?= "*.la *-config *_config postinst-*"
 SSTATE_SCAN_CMD ??= 'find ${SSTATE_BUILDDIR} \( -name "${@"\" -o -name \"".join(d.getVar("SSTATE_SCAN_FILES").split())}" \) -type f'
 SSTATE_SCAN_CMD_NATIVE ??= 'grep -Irl -e ${RECIPE_SYSROOT} -e ${RECIPE_SYSROOT_NATIVE} -e ${HOSTTOOLS_DIR} ${SSTATE_BUILDDIR}'
+SSTATE_HASHEQUIV_FILEMAP ?= " \
+    populate_sysroot:*/postinst-useradd-*:${TMPDIR} \
+    populate_sysroot:*/postinst-useradd-*:${COREBASE} \
+    populate_sysroot:*/postinst-useradd-*:regex-\s(PATH|PSEUDO_IGNORE_PATHS|HOME|LOGNAME|OMP_NUM_THREADS|USER)=.*\s \
+    populate_sysroot:*/crossscripts/*:${TMPDIR} \
+    populate_sysroot:*/crossscripts/*:${COREBASE} \
+    "
 
 BB_HASHFILENAME = "False ${SSTATE_PKGSPEC} ${SSTATE_SWSPEC}"