subtree updates

poky: 67266331b0..835f7eac06:
  Adrian Bunk (9):
        valgrind: Remove dependency on libx11
        bluez5: Remove obsolete dependency on dbus-glib
        python3-dbus: Remove obsolete dependency on dbus-glib
        cups: Remove unnecessary dependency on dbus-glib
        libnotify: Remove obsolete dependency on dbus-glib
        unfs3: Switch to new upstream location
        i2c-tools: Add alternative for i2ctransfer
        meta: Remove remnants of bluez4 support
        e2fsprogs: Remove patch that disabled 64bit for ext4 by default

  Adrian Freihofer (1):
        yocto-bsp: runqemu runs beaglebone-yocto

  Adrian Ratiu (1):
        opkg/package/rootfs_ipk: allow overwriting OPKGLIBDIR

  Alejandro del Castillo (1):
        opkg: upgrade to version 0.4.1

  Alexander Kanavin (3):
        rt-tests: exclude 1.4 version from upstream check as well
        gtk-doc: correct the style.css permissions
        mobile-broadband-provider-info: upgrade 20190116 -> 20190618

  Alistair Francis (7):
        mesa: Add support for the lima PACKAGECONFIG
        u-boot: Update to 2019.07
        packagegroup-core-sdk: Set blank sanitiser for RISC-V 32
        opensbi: Update from 0.3 to 0.4
        opensbi: Fix installed-vs-shipped warning
        qemurunner.py: Be more verbose about problems
        package_manager: Ensure the base-feed directory exists

  Andrej Valek (2):
        busybox: 1.30.1 -> 1.31.0
        oe/copy_buildsystem: move layer into layers directory

  Anuj Mittal (25):
        gstreamer1.0-plugins-bad: depend on vulkan-loader now
        vulkan-demos: depend on vulkan-loader
        vulkan: remove
        binutils: fix CVE-2019-12972 CVE-2019-9071
        gnupg: upgrade 2.2.16 -> 2.2.17
        libxslt: fix CVE-2019-13117 CVE-2019-13118
        libva: upgrade 2.4.1 -> 2.5.0
        libva-utils: upgrade 2.4.0 -> 2.5.0
        nasm: fix CVE-2018-19755
        python: fix CVE-2019-9740
        python3: upgrade 3.7.3 -> 3.7.4
        binutils: CVE-2019-9070 is same as CVE-2019-9071
        qemu: fix CVE-2019-12155
        bzip2: upgrade 1.0.7 -> 1.0.8
        glib-2.0: upgrade 2.60.4 -> 2.60.5
        vte: upgrade 0.56.1 -> 0.56.3
        openssl: set CVE vendor to openssl
        curl: upgrade 7.65.1 -> 7.65.2
        rsync: fix CVEs for included zlib
        glibc: CVE-2018-20796 is same as CVE-2019-9169
        unzip: fix CVE-2019-13232
        python: include CVE patches for python-native as well
        gdb: fix CVE-2017-9778
        iptables: upgrade 1.8.2 -> 1.8.3
        piglit: fix SRC_URI

  Armin Kuster (1):
        timezone: update to 2019b

  Bonnans, Laurent (1):
        openssl: fix valgrind errors on v1.1.1c

  Bruce Ashfield (5):
        linux-yocto/5.0: bsp: add basic xilinx zynqmp support
        linux-yocto/5.0: make scsi-debug include scsi core configs
        linux-yocto: bsp/beaglebone: support qemu -machine virt
        linux-yocto/4.19: update to 4.19.57 and -rt22
        package: check PKG_ variables before executing ontarget postinst

  CHerzig@Gauselmann.de (1):
        bitbake: fetch2/clearcase: Fix class import errors

  Changqing Li (5):
        quilt: run-ptest remove Interactive Input
        mdadm: fix systemd service start up failure
        mdam: fix mdmonitor start up failure
        opkg: make ptest output format align with common style
        mdadm: make ptest output format align with common style

  Chee Yang Lee (1):
        wic: add support for kernel with initramfs bundled

  Chen Qi (13):
        target-sdk-provides-dummy: add libperl.so.5 64bit
        devtool: warn user about multiple layer having the same base name
        image.bbclass: fix systemd_preset_all
        devtool.py: track to clean devtool.conf in test_create_workspace
        grub-efi.bbclass: take into consideration of multilib
        sysstat: use service file from source codes
        xmlcatalog: hold libxml2-native dependency
        oeqa/runtime/rpm: ensure no user process running before deleting user
        oeqa/runtime/rpm: Move test_rpm_query_nonroot test case to RpmBasicTest
        qemurunner.py: fix race condition at qemu startup
        msmtp: use alternatives to manage /usr/lib/sendmail
        runtime_test.py: use track_for_cleanup for temp dir
        devtool: remove temp dir in upgrade

  Fabio Berton (1):
        mesa: Update 19.1.0 -> 19.1.1

  Haiqing Bai (1):
        sysstat: Use sysstat.service in source for cron with systemd

  He Zhe (1):
        ltp: file01: Fix in was not recognized

  Hongzhi.Song (3):
        ltp: fix shmctl01 failure when executed.
        ltp: diotest4: Let kernel pick an address when calling mmap
        ltp: getrlimit03: adjust-a-bit-of-code-to-compatiable-with mips32

  Jason Wessel (5):
        glibc: Fix multilibs + usrmerge builds
        psmisc: Fix dependency for USE_NLS=no
        glibc-locale: Fix build error with PACKAGE_NO_GCONV = "1"
        glibc/glibc-locale: Fix do_stash_locale to work with usrmerge and multilibs
        glibc / glibc-locale: Fix stash_locale determinism problems

  Joe Slater (1):
        libtool: remove host information from libtool

  Jon Mason (1):
        oe_syslog.py: Handle syslogd/klogd restart race

  Joshua Watt (5):
        python3: Fix .pyc file reproduciblility
        oeqa: Test bitbake --skip-setsecene
        bitbake: bitbake: Add --skip-setscene option
        classes/icecc: Disable remote pre-processing by default
        scripts/buildstats-diff: Add option to filter tasks

  Joël Esponde (1):
        package.bbclass: fix directories setuid and setgid bits

  Jun Nie (1):
        kernel-fitimage: uboot-sign: fix missing signature

  Kai Kang (4):
        rng-tools: fix rngd blocks system shutdown
        openssl: fix multilib files conflict
        webkitgtk: set incomptible with tune mips
        defaultsetup.conf: enable select init manager

  Khem Raj (10):
        efibootmgr: Pass correct flags to compiler from pkg-config
        mpeg2dec: Fix PIE build and avoid relocation in text section on ARM
        Revert "unzip: fix CVE-2019-13232"
        musl: Upgrade to 1.1.23+
        mdadm: Include sys/sysmacros.h for major/minor definitions
        sysvinit: Include sys/sysmacros.h for major/minor definitions on musl too
        pam_systemd: Include missing.h for secure_getenv
        musl-obstack: Add recipe
        elfutils: Fix eu-* utils builds for musl
        maintainers: Account for musl-obstack and libssp-nonshared

  Li Zhou (2):
        bc: dc: fix exit code of q command
        iptables: Security Advisory - iptables - CVE-2019-11360

  Luca Boccassi (1):
        bitbake: tests/fetch.py: add missing skipIfNoNetwork tags to tests that try to git clone

  Matthias Schiffer (1):
        systemd: backport patch to fix sysctl warning on boot

  Mike Crowe (4):
        bitbake.conf: Stop exporting TARGET_ flags variables
        image.bbclass: Only append to IMAGE_LINK_NAME if it was already set
        rootfs-postcommands: Cope with empty IMAGE_LINK_NAME in write_image_manifest
        rootfs-postcommands: Cope with empty IMAGE_LINK_NAME in write_image_test_data

  Mikko Rapeli (3):
        busybox: enable unicode support
        cve-check.bbclass: initialize to_append
        freetype: add --tag CC to libtool arguments

  Mingli Yu (2):
        go.bbclass: separate the ptest logic to go-ptest class
        mdadm: fix ptest hang

  Oleksandr Kravchuk (34):
        mc: update to 4.8.23
        encodings: update to 1.0.5
        gawk: update to 5.0.1
        libinput: update to 1.13.3
        libxi: update to 1.7.10
        libxt: update to 1.2.0
        autoconf-archive: update to 2019.01.06
        python3-mako: update to 1.0.12
        python3-pbr: update to 5.3.1
        python3-pygobject: update to 3.32.2
        git: update to 2.22.0
        eudev: update to 3.2.8
        babeltrace: update to 1.5.7
        dpkg: update to 1.19.7
        apt: update to 1.2.31
        libinput: update to 1.13.4
        expat: update to 2.2.7
        libsolf: update to 0.7.5
        bison: update to 3.4.1
        ruby: update to 2.5.5
        quilt: update to 0.66
        bzip2: update to 1.0.7
        python3-mako: update to 1.0.13
        ifupdown: update to 0.8.22
        libdrm: update to 2.4.99
        python3-pbr: update to 5.4.0
        linux-firmware: bump to 20190618
        iproute2: update to 5.2.0
        udev-extraconf: do not mount swap partitions
        python3-pbr: update to 5.4.1
        xinput: update to 1.6.3
        python3-scons: update to 3.1.0
        python3-docutils: update to 0.15
        python3-mako: update to 1.0.14

  Pascal Bach (1):
        cmake: 3.14.1 -> 3.14.5

  Paul Eggleton (7):
        libcap-ng: do not use symlink to share files with libcap-ng-python
        scripts/contrib/ddimage: fix typo
        scripts/contrib/ddimage: replace blacklist with mount check
        scripts/contrib/ddimage: be explicit whether device doesn't exist or isn't writeable
        list-packageconfig-flags: print PN instead of P
        recipetool: ignore zero-length setup.py files
        devtool: upgrade: fix handling of errors parsing upgraded recipe

  Peter Kjellerstedt (4):
        glib-2.0: Update to 2.60.4
        glibc-package.inc: Do not use bitbake variable syntax for shell variables
        meson.bbclass: Remove the MESON_*_ARGS variables
        nativesdk-meson: Remove some unused variables

  Pierre Le Magourou (10):
        cve-update-db: Use std library instead of urllib3
        cve-update-db: Manage proxy if needed.
        cve-update-db: do_populate_cve_db depends on do_fetch
        cve-update-db: Catch request.urlopen errors.
        cve-check: Depends on cve-update-db-native
        cve-update-db: Use NVD CPE data to populate PRODUCTS table
        cve-check: Update unpatched CVE matching
        cve-update-db-native: Skip recipe when cve-check class is not loaded.
        cve-check: Replace CVE_CHECK_CVE_WHITELIST by CVE_CHECK_WHITELIST
        cve-update-db-native: Remove hash column from database.

  Ricardo Ribalda Delgado (4):
        nfs-mountd: Add missing dependency on systemd service
        systemd: Fix interface bring-up on kernels >= 5.2
        wic: Fix (again) partition files UIDs on multi rootfs images
        systemd-bootconf: Mark as machine specific

  Ricardo Salveti (1):
        gcc-9.1: add back GLIBC_DYNAMIC_LINKER riscv changes

  Richard Purdie (58):
        multilib_global: Fix multilib rebuild issue
        multilib_global: Fix KERNEL_VERSION expansion problems
        sysklogd: Fix init script races
        busybox: Improve syslog restart handling
        oeqa/runtime/syslog: Improve test debug messages
        oeqa/runtime/oesyslog: systemd syslog restart doesn't change pid
        oeqa/runtime/syslog: Add delay to test to avoid failures
        busybox: Fix typo in syslog initscript
        pigz: Add debug for autobuilder errors
        staging: Code cleanup
        package: Build pkgdata specific to the current recipe
        Revert "pigz: Add debug for autobuilder errors"
        grub2: Drop unneeded code
        bitbake: event: Clear ui_queue after handling it
        bitbake: main: Ensure log messages are printed when no UI starts
        bitbake: main: Alter EOFError handling
        core-image-sato-sdk-ptest: Reduce image padding size due to bootimg 4GB limit
        oeqa/bbtests: Tweak test bitbake output pattern matching
        sstate: Add tweak to avoid multiple sstate stats messages
        bitbake: siggen: Fix default handler
        bitbake: siggen: Use unique hashes for tasks
        bitbake: runqueue: Tweak buildable variable handling in scheduler
        bitbake: runqueue: Drop unused BB_SETSCENE_VERIFY_FUNCTION2
        bitbake: runqueue: Remove now uneeded code
        bitbake: runqueue: Move scenequeue data generation to a separate function
        bitbake: runqueue: Remove unused function parameter
        bitbake: runqueue: Factor out the process_setscene_whitelist checks
        bitbake: runqueue: Uniquely namespace the scenequeue functions
        bitbake: runqueue: Merge stats handling together for setscene/real tasks
        bitbake: runqueue: Merge scenequeue and real task queue code together
        bitbake: runqueue: Fix counter/task updating glitch
        bitbake: runqueue: Remove RunQueueExecuteScenequeue and RunQueueExecuteTasks
        bitbake: runqueue: Simplify _execute_runqueue logic
        bitbake: runqueue: Fold remains of the scenequeue setup into RunQueueExecute
        bitbake: event/runqueue: Drop StampUpdate event, its pointless/unused
        bitbake: runqueue: Add covered_tasks (or 'collated_deps') to scenequeue data
        bitbake: runqueue: Simplify scenequeue unskippable calculation
        bitbake: runqueue: Tweak comments and debug code
        bitbake: runqueue: Code simplification
        bitbake: runqueue: Remove pointless variable
        bitbake: runqueue: Further scheduler buildable tasks cleanup
        bitbake: runqueue: Clarify scenequeue_covered vs. tasks_covered
        bitbake: runqueue: Merge the queues and execute setscene and normal tasks in parallel
        bitbake: runqueue: Alter setscenewhitelist handling
        bitbake: runqueue: Complete the merge of scenequeue and normal task execution
        bitbake: tests: Add initial scenario based test for runqueue
        bitbake: uihelper: No longer listen to scenequeue task started
        bitbake: runqueue: Simplify some convoluted logic
        bitbake: runqueue: Whitespace fix
        bitbake: runqueue: Abstract hash verification function
        bitbake: runqueue: Optimise multiconfig with overlapping setscene
        bitbake: tests/runqueue: Allow common sstate tasks to become valid
        bitbake: runqueue: Fix non setscene tasks targets being lost
        staging: Drop clean_recipe_sysroot
        poky-lsb: Drop features already in poky
        poky-lsb: Drop libx11 PREFERRED_PROVIDER
        distro/include: Add poky-distro-alt-test-config.inc
        bitbake: siggen: Fix handling of tainted sig files

  Robert Yang (13):
        update-alternatives.bbclass: run update-alternatives firstly in postinst script
        busybox: make postinst run firstly before update-alternatives
        multilib.bbclass: Reduce ALTERNATIVE_PRIORITY for extended recipes
        bitbake: bitbake: lib: Cleanup /usr/bin/env python
        bitbake: bitbake: toaster:tests: python -> python3
        ksum.py: python -> python3
        wic: python2 -> python3
        ext-sdk-prepare.py: python2 -> python3
        oeqa: Cleanup /usr/bin/env python
        package_rpm.bbclass: python2 -> python3
        bitbake: cache: Remove duplicated lines for provides and rprovides
        bitbake: cache: Set packages for skipped recipes
        bitbake: cache: Create a symlink for current cachefile

  Ross Burton (56):
        cve-check: be idiomatic
        gtk-icon-cache: rename intercept to update_gtk_icon_cache
        fortran-helloworld: add a very dumb Fortran Hello World for testing
        oeqa/buildoptions: check that Fortran code actually cross-compiles
        buildhistory: write the contents of the sysroot
        buildhistory: report sysroot changes
        perl: fix Upstream-Status tags
        efivar: ensure that target security flags are not used to build native code
        multilib_script: fix whitespace
        buildhistory_analysis: ignore ownership for sysroot diffs
        insane: use clean_path for the host contamination warnings
        libsndfile1: disable use of sqlite3 by default
        libsndfile1: remove redundant autoconf seeding
        buildhistory: don't output ownership for the sysroot
        buildhistory: filter out the unexpected prefix for native/cross sysroots
        alsa-utils: disable tools using GTK+2
        packagegroup-core-lsb: remove GTK+
        recipetool: add MD5 hash for the line-wrapped MPL-1.1 license
        oeqa/recipetool: change the CMake test to use taglib
        gtk+: remove GTK+ 2
        gnome-themes-standard: remove
        Revert "sysstat: use service file from source codes"
        libpsl: update Upstream-Status
        grub: build with python 3
        qemu: use Python 3 to build
        ninja: use Python 3
        conf/poky: add debian-10 to the supported distribution list
        tiff: remove redundant patch
        tiff: fix CVE-2019-6128
        tiff: fix CVE-2019-7663
        cve-check: remove redundant readline CVE whitelisting
        cve-check-tool: remove
        glibc: exclude child recipes from CVE scanning
        libid3tag: CVE-2017-11551 is the same as CVE-2004-2779
        libid3tag: handle unknown encodings (CVE-2017-11550)
        subversion: set CVE vendor to Apache
        boost: set CVE vendor to Boost
        git: set CVE vendor to git-scm
        ed: set CVE vendor to avoid false positives
        cve-check: allow comparison of Vendor as well as Product
        flex: set CVE_PRODUCT to include vendor
        cve-update-db-native: use SQL placeholders instead of format strings
        xkeyboard-config: remove redundant intltool dependency
        piglit: upgrade to latest revision
        pkgconf: upgrade 1.6.1 -> 1.6.3
        conf/poky: add Fedora 30 and Opensuse Leap 15.1 to supported distributions
        cve-update-db-native: use os.path.join instead of +
        cve-update-db: actually inherit native
        cve-update-db-native: use executemany() to optimise CPE insertion
        cve-update-db-native: improve metadata parsing
        cve-update-db-native: clean up JSON fetching
        freetype: upgrade to 2.10.1
        unfs3: set upstream tag regex to avoid false-positives
        meson.bbclass: export STRIP=${BUILD_STRIP}
        ffmpeg: don't use hardcoded lookup tables
        ffmpeg: upgrade to 4.1.4

  Sai Hari Chandana Kalluri (3):
        devtool/standard.py: Update devtool modify to copy source from work-shared if its already downloaded
        devtool/standard.py: Create a copy of kernel source within work-shared if not present
        devtool: provide support for devtool menuconfig command

  Scott Rifenbark (5):
        overview-manual: Fixed manual history table
        sdk-manual: Updated devtool to talk about oe-local-files.
        dev-manual: Provided proper link title
        ref-manual: Fixed typo for BBMULTICONFIG variable.
        ref-manual: Removed "python2" mention in example.

  Stefan Agner (1):
        psplash: create psplash tmpfs mount directory in psplash-init

  Tim Orling (3):
        vulkan-headers: add recipe
        vulkan-loader: add recipe
        vulkan-tools: add recipe

  Ulrich Ölmann (1):
        squashfs-tools: upgrade to commit f95864afe883

  William Bourque (2):
        wic/plugins: Source that support both EFI and BIOS
        meta/lib/oeqa: Test for bootimg-biosplusefi Source

  Yi Zhao (2):
        debianutils: upgrade 4.8.6.1 -> 4.8.6.3
        ltp: upgrade 20190115 -> 20190517

  Zang Ruochen (9):
        nss: upgrade 3.44 -> 3.44.1
        util-linux:upgrade 2.33.2 -> 2.34
        librepo:upgrade 1.10.3 -> 1.10.4
        sqlite3: Upgrade 3.28.0 -> 3.29.0
        nss: Upgrade 3.44.1 -> 3.45
        xauth:upgrade 1.0.10 -> 1.1
        libice:upgrade 1.0.9 -> 1.0.10
        xwininfo:upgrade 1.1.4 -> 1.1.5
        libpciaccess:upgrade 0.14 -> 0.16

meta-phosphor: fe8cee7488..601f253a66:
  Brad Bishop (1):
        meta-phosphor: systemd: remove upstreamed patches

Change-Id: If591144821cd2e5b990a7aa49a1cf426f6a906de
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>

5 files changed, 0 insertions, 503 deletions

diff --git a/poky/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch b/poky/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch
deleted file mode 100644
index 4a82cf2dd..000000000
--- a/poky/meta/recipes-devtools/cve-check-tool/files/0001-Fix-freeing-memory-allocated-by-sqlite.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From a3353429652f83bb8b0316500faa88fa2555542d Mon Sep 17 00:00:00 2001
-From: Peter Marko <peter.marko@siemens.com>
-Date: Thu, 13 Apr 2017 23:09:52 +0200
-Subject: [PATCH] Fix freeing memory allocated by sqlite
-
-Upstream-Status: Backport
-Signed-off-by: Peter Marko <peter.marko@siemens.com>
----
- src/core.c | 8 ++++----
- 1 file changed, 4 insertions(+), 4 deletions(-)
-
-diff --git a/src/core.c b/src/core.c
-index 6263031..6788f16 100644
---- a/src/core.c
-+++ b/src/core.c
-@@ -82,7 +82,7 @@ static bool ensure_table(CveDB *self)
-         rc = sqlite3_exec(self->db, query, NULL, NULL, &err);
-         if (rc != SQLITE_OK) {
-                 fprintf(stderr, "ensure_table(): %s\n", err);
--                free(err);
-+                sqlite3_free(err);
-                 return false;
-         }
-         
-@@ -91,7 +91,7 @@ static bool ensure_table(CveDB *self)
-         rc = sqlite3_exec(self->db, query, NULL, NULL, &err);
-         if (rc != SQLITE_OK) {
-                 fprintf(stderr, "ensure_table(): %s\n", err);
--                free(err);
-+                sqlite3_free(err);
-                 return false;
-         }
- 
-@@ -99,11 +99,11 @@ static bool ensure_table(CveDB *self)
-         rc = sqlite3_exec(self->db, query, NULL, NULL, &err);
-         if (rc != SQLITE_OK) {
-                 fprintf(stderr, "ensure_table(): %s\n", err);
--                free(err);
-+                sqlite3_free(err);
-                 return false;
-         }
-         if (err) {
--                free(err);
-+                sqlite3_free(err);
-         }
- 
-         return true;
--- 
-2.1.4
-
diff --git a/poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch b/poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch
deleted file mode 100644
index 3d8ebd1bd..000000000
--- a/poky/meta/recipes-devtools/cve-check-tool/files/0001-curl-allow-overriding-default-CA-certificate-file.patch
+++ /dev/null
@@ -1,215 +0,0 @@
-From 825a9969dea052b02ba868bdf39e676349f10dce Mon Sep 17 00:00:00 2001
-From: Jussi Kukkonen <jussi.kukkonen@intel.com>
-Date: Thu, 9 Feb 2017 14:51:28 +0200
-Subject: [PATCH] curl: allow overriding default CA certificate file
-
-Similar to curl, --cacert can now be used in cve-check-tool and
-cve-check-update to override the default CA certificate file. Useful
-in cases where the system default is unsuitable (for example,
-out-dated) or broken (as in OE's current native libcurl, which embeds
-a path string from one build host and then uses it on another although
-the right path may have become something different).
-
-Upstream-Status: Submitted [https://github.com/ikeydoherty/cve-check-tool/pull/45]
-
-Signed-off-by: Patrick Ohly <patrick.ohly@intel.com>
-
-
-Took Patrick Ohlys original patch from meta-security-isafw, rebased
-on top of other patches.
-
-Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
----
- src/library/cve-check-tool.h |  1 +
- src/library/fetch.c          | 10 +++++++++-
- src/library/fetch.h          |  3 ++-
- src/main.c                   |  5 ++++-
- src/update-main.c            |  4 +++-
- src/update.c                 | 12 +++++++-----
- src/update.h                 |  2 +-
- 7 files changed, 27 insertions(+), 10 deletions(-)
-
-diff --git a/src/library/cve-check-tool.h b/src/library/cve-check-tool.h
-index e4bb5b1..f89eade 100644
---- a/src/library/cve-check-tool.h
-+++ b/src/library/cve-check-tool.h
-@@ -43,6 +43,7 @@ typedef struct CveCheckTool {
-     bool bugs;                          /**<Whether bug tracking is enabled */
-     GHashTable *mapping;                /**<CVE Mapping */
-     const char *output_file;            /**<Output file, if any */
-+    const char *cacert_file;            /**<Non-default SSL certificate file, if any */
- } CveCheckTool;
- 
- /**
-diff --git a/src/library/fetch.c b/src/library/fetch.c
-index 0fe6d76..8f998c3 100644
---- a/src/library/fetch.c
-+++ b/src/library/fetch.c
-@@ -60,7 +60,8 @@ static int progress_callback_new(void *ptr, curl_off_t dltotal, curl_off_t dlnow
- }
- 
- FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
--                      unsigned int start_percent, unsigned int end_percent)
-+                      unsigned int start_percent, unsigned int end_percent,
-+                      const char *cacert_file)
- {
-         FetchStatus ret = FETCH_STATUS_FAIL;
-         CURLcode res;
-@@ -74,6 +75,13 @@ FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
-                 return ret;
-         }
- 
-+        if (cacert_file) {
-+                res = curl_easy_setopt(curl, CURLOPT_CAINFO, cacert_file);
-+                if (res != CURLE_OK) {
-+                        goto bail;
-+                }
-+        }
-+
-         if (stat(target, &st) == 0) {
-                 res = curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
-                 if (res != CURLE_OK) {
-diff --git a/src/library/fetch.h b/src/library/fetch.h
-index 4cce5d1..836c7d7 100644
---- a/src/library/fetch.h
-+++ b/src/library/fetch.h
-@@ -29,7 +29,8 @@ typedef enum {
-  * @return A FetchStatus, indicating the operation taken
-  */
- FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
--                      unsigned int this_percent, unsigned int next_percent);
-+                      unsigned int this_percent, unsigned int next_percent,
-+                      const char *cacert_file);
- 
- /**
-  * Attempt to extract the given gzipped file
-diff --git a/src/main.c b/src/main.c
-index 8e6f158..ae69d47 100644
---- a/src/main.c
-+++ b/src/main.c
-@@ -280,6 +280,7 @@ static bool csv_mode = false;
- static char *modified_stamp = NULL;
- static gchar *mapping_file = NULL;
- static gchar *output_file = NULL;
-+static gchar *cacert_file = NULL;
- 
- static GOptionEntry _entries[] = {
-         { "not-patched", 'n', 0, G_OPTION_ARG_NONE, &hide_patched, "Hide patched/addressed CVEs", NULL },
-@@ -294,6 +295,7 @@ static GOptionEntry _entries[] = {
-         { "csv", 'c', 0, G_OPTION_ARG_NONE, &csv_mode, "Output CSV formatted data only", NULL },
-         { "mapping", 'M', 0, G_OPTION_ARG_STRING, &mapping_file, "Path to a mapping file", NULL},
-         { "output-file", 'o', 0, G_OPTION_ARG_STRING, &output_file, "Path to the output file (output plugin specific)", NULL},
-+        { "cacert", 'C', 0, G_OPTION_ARG_STRING, &cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL},
-         { .short_name = 0 }
- };
- 
-@@ -492,6 +494,7 @@ int main(int argc, char **argv)
- 
-         quiet = csv_mode || !no_html;
-         self->output_file = output_file;
-+        self->cacert_file = cacert_file;
- 
-         if (!csv_mode && self->output_file) {
-                 quiet = false;
-@@ -530,7 +533,7 @@ int main(int argc, char **argv)
-                 if (status) {
-                         fprintf(stderr, "Update of db forced\n");
-                         cve_db_unlock();
--                        if (!update_db(quiet, db_path->str)) {
-+                        if (!update_db(quiet, db_path->str, self->cacert_file)) {
-                                 fprintf(stderr, "DB update failure\n");
-                                 goto cleanup;
-                         }
-diff --git a/src/update-main.c b/src/update-main.c
-index 2379cfa..c52d9d0 100644
---- a/src/update-main.c
-+++ b/src/update-main.c
-@@ -43,11 +43,13 @@ the Free Software Foundation; either version 2 of the License, or\n\
- static gchar *nvds = NULL;
- static bool _show_version = false;
- static bool _quiet = false;
-+static const char *_cacert_file = NULL;
- 
- static GOptionEntry _entries[] = {
-         { "nvd-dir", 'd', 0, G_OPTION_ARG_STRING, &nvds, "NVD directory in filesystem", NULL },
-         { "version", 'v', 0, G_OPTION_ARG_NONE, &_show_version, "Show version", NULL },
-         { "quiet", 'q', 0, G_OPTION_ARG_NONE, &_quiet, "Run silently", NULL },
-+        { "cacert", 'C', 0, G_OPTION_ARG_STRING, &_cacert_file, "Path to the combined SSL certificates file (system default is used if not set)", NULL},
-         { .short_name = 0 }
- };
- 
-@@ -88,7 +90,7 @@ int main(int argc, char **argv)
-                 goto end;
-         }
- 
--        if (update_db(_quiet, db_path->str)) {
-+        if (update_db(_quiet, db_path->str, _cacert_file)) {
-                 ret = EXIT_SUCCESS;
-         } else {
-                 fprintf(stderr, "Failed to update database\n");
-diff --git a/src/update.c b/src/update.c
-index 070560a..8cb4a39 100644
---- a/src/update.c
-+++ b/src/update.c
-@@ -267,7 +267,8 @@ static inline void update_end(int fd, const char *update_fname, bool ok)
- 
- static int do_fetch_update(int year, const char *db_dir, CveDB *cve_db,
-                            bool db_exist, bool verbose,
--                           unsigned int this_percent, unsigned int next_percent)
-+                           unsigned int this_percent, unsigned int next_percent,
-+                           const char *cacert_file)
- {
-         const char nvd_uri[] = URI_PREFIX;
-         autofree(cve_string) *uri_meta = NULL;
-@@ -331,14 +332,14 @@ refetch:
-         }
- 
-         /* Fetch NVD META file */
--        st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent);
-+        st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent, cacert_file);
-         if (st == FETCH_STATUS_FAIL) {
-                 fprintf(stderr, "Failed to fetch %s\n", uri_meta->str);
-                 return -1;
-         }
- 
-         /* Fetch NVD XML file */
--        st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent);
-+        st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent, cacert_file);
-         switch (st) {
-         case FETCH_STATUS_FAIL:
-                 fprintf(stderr, "Failed to fetch %s\n", uri_data_gz->str);
-@@ -391,7 +392,7 @@ refetch:
-         return 0;
- }
- 
--bool update_db(bool quiet, const char *db_file)
-+bool update_db(bool quiet, const char *db_file, const char *cacert_file)
- {
-         autofree(char) *db_dir = NULL;
-         autofree(CveDB) *cve_db = NULL;
-@@ -466,7 +467,8 @@ bool update_db(bool quiet, const char *db_file)
-                 if (!quiet)
-                         fprintf(stderr, "completed: %u%%\r", start_percent);
-                 rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet,
--                                     start_percent, end_percent);
-+                                     start_percent, end_percent,
-+                                     cacert_file);
-                 switch (rc) {
-                 case 0:
-                         if (!quiet)
-diff --git a/src/update.h b/src/update.h
-index b8e9911..ceea0c3 100644
---- a/src/update.h
-+++ b/src/update.h
-@@ -15,7 +15,7 @@ cve_string *get_db_path(const char *path);
- 
- int update_required(const char *db_file);
- 
--bool update_db(bool quiet, const char *db_file);
-+bool update_db(bool quiet, const char *db_file, const char *cacert_file);
- 
- 
- /*
--- 
-2.1.4
-
diff --git a/poky/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch b/poky/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch
deleted file mode 100644
index 8ea6f686e..000000000
--- a/poky/meta/recipes-devtools/cve-check-tool/files/0001-print-progress-in-percent-when-downloading-CVE-db.patch
+++ /dev/null
@@ -1,135 +0,0 @@
-From e9ed26cde63f8ca7607a010a518329339f8c02d3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <git@andred.net>
-Date: Mon, 26 Sep 2016 12:12:41 +0100
-Subject: [PATCH] print progress in percent when downloading CVE db
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Upstream-Status: Pending
-Signed-off-by: André Draszik <git@andred.net>
----
- src/library/fetch.c | 28 +++++++++++++++++++++++++++-
- src/library/fetch.h |  3 ++-
- src/update.c        | 16 ++++++++++++----
- 3 files changed, 41 insertions(+), 6 deletions(-)
-
-diff --git a/src/library/fetch.c b/src/library/fetch.c
-index 06d4b30..0fe6d76 100644
---- a/src/library/fetch.c
-+++ b/src/library/fetch.c
-@@ -37,13 +37,37 @@ static size_t write_func(void *ptr, size_t size, size_t nmemb, struct fetch_t *f
-         return fwrite(ptr, size, nmemb, f->f);
- }
- 
--FetchStatus fetch_uri(const char *uri, const char *target, bool verbose)
-+struct percent_t {
-+        unsigned int start;
-+        unsigned int end;
-+};
-+
-+static int progress_callback_new(void *ptr, curl_off_t dltotal, curl_off_t dlnow, curl_off_t ultotal, curl_off_t ulnow)
-+{
-+        (void) ultotal;
-+        (void) ulnow;
-+
-+        struct percent_t *percent = (struct percent_t *) ptr;
-+
-+        if (dltotal && percent && percent->end >= percent->start) {
-+                unsigned int diff = percent->end - percent->start;
-+                if (diff) {
-+                        fprintf(stderr,"completed: %"CURL_FORMAT_CURL_OFF_T"%%\r", percent->start + (diff * dlnow / dltotal));
-+                }
-+        }
-+
-+        return 0;
-+}
-+
-+FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
-+                      unsigned int start_percent, unsigned int end_percent)
- {
-         FetchStatus ret = FETCH_STATUS_FAIL;
-         CURLcode res;
-         struct stat st;
-         CURL *curl = NULL;
-         struct fetch_t *f = NULL;
-+        struct percent_t percent = { .start = start_percent, .end = end_percent };
- 
-         curl = curl_easy_init();
-         if (!curl) {
-@@ -67,6 +91,8 @@ FetchStatus fetch_uri(const char *uri, const char *target, bool verbose)
-         }
-         if (verbose) {
-                 (void)curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L);
-+                (void)curl_easy_setopt(curl, CURLOPT_XFERINFODATA, &percent);
-+                (void)curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progress_callback_new);
-         }
-         res = curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, (curl_write_callback)write_func);
-         if (res != CURLE_OK) {
-diff --git a/src/library/fetch.h b/src/library/fetch.h
-index 70c3779..4cce5d1 100644
---- a/src/library/fetch.h
-+++ b/src/library/fetch.h
-@@ -28,7 +28,8 @@ typedef enum {
-  * @param verbose Whether to be verbose
-  * @return A FetchStatus, indicating the operation taken
-  */
--FetchStatus fetch_uri(const char *uri, const char *target, bool verbose);
-+FetchStatus fetch_uri(const char *uri, const char *target, bool verbose,
-+                      unsigned int this_percent, unsigned int next_percent);
- 
- /**
-  * Attempt to extract the given gzipped file
-diff --git a/src/update.c b/src/update.c
-index 30fbe96..eaeeefd 100644
---- a/src/update.c
-+++ b/src/update.c
-@@ -266,7 +266,8 @@ static inline void update_end(int fd, const char *update_fname, bool ok)
- }
- 
- static int do_fetch_update(int year, const char *db_dir, CveDB *cve_db,
--                           bool db_exist, bool verbose)
-+                           bool db_exist, bool verbose,
-+                           unsigned int this_percent, unsigned int next_percent)
- {
-         const char nvd_uri[] = URI_PREFIX;
-         autofree(cve_string) *uri_meta = NULL;
-@@ -330,14 +331,14 @@ refetch:
-         }
- 
-         /* Fetch NVD META file */
--        st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose);
-+        st = fetch_uri(uri_meta->str, nvdcve_meta->str, verbose, this_percent, this_percent);
-         if (st == FETCH_STATUS_FAIL) {
-                 fprintf(stderr, "Failed to fetch %s\n", uri_meta->str);
-                 return -1;
-         }
- 
-         /* Fetch NVD XML file */
--        st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose);
-+        st = fetch_uri(uri_data_gz->str, nvdcve_data_gz->str, verbose, this_percent, next_percent);
-         switch (st) {
-         case FETCH_STATUS_FAIL:
-                 fprintf(stderr, "Failed to fetch %s\n", uri_data_gz->str);
-@@ -459,10 +460,17 @@ bool update_db(bool quiet, const char *db_file)
-         for (int i = YEAR_START; i <= year+1; i++) {
-                 int y = i > year ? -1 : i;
-                 int rc;
-+                unsigned int start_percent = ((i+0 - YEAR_START) * 100) / (year+2 - YEAR_START);
-+                unsigned int end_percent = ((i+1 - YEAR_START) * 100) / (year+2 - YEAR_START);
- 
--                rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet);
-+                if (!quiet)
-+                        fprintf(stderr, "completed: %u%%\r", start_percent);
-+                rc = do_fetch_update(y, db_dir, cve_db, db_exist, !quiet,
-+                                     start_percent, end_percent);
-                 switch (rc) {
-                 case 0:
-+                        if (!quiet)
-+                                fprintf(stderr,"completed: %u%%\r", end_percent);
-                         continue;
-                 case ENOMEM:
-                         goto oom;
--- 
-2.9.3
-
diff --git a/poky/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch b/poky/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch
deleted file mode 100644
index 458c0cc84..000000000
--- a/poky/meta/recipes-devtools/cve-check-tool/files/0001-update-Compare-computed-vs-expected-sha256-digit-str.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From b0426e63c9ac61657e029f689bcb8dd051e752c6 Mon Sep 17 00:00:00 2001
-From: Sergey Popovich <popovich_sergei@mail.ua>
-Date: Fri, 21 Apr 2017 07:32:23 -0700
-Subject: [PATCH] update: Compare computed vs expected sha256 digit string
- ignoring case
-
-We produce sha256 digest string using %x snprintf()
-qualifier for each byte of digest which uses alphabetic
-characters from "a" to "f" in lower case to represent
-integer values from 10 to 15.
-
-Previously all of the NVD META files supply sha256
-digest string for corresponding XML file in lower case.
-
-However due to some reason this changed recently to
-provide digest digits in upper case causing fetched
-data consistency checks to fail. This prevents database
-from being updated periodically.
-
-While commit c4f6e94 (update: Do not treat sha256 failure
-as fatal if requested) adds useful option to skip
-digest validation at all and thus provides workaround for
-this situation, it might be unacceptable for some
-deployments where we need to ensure that downloaded
-data is consistent before start parsing it and update
-SQLite database.
-
-Use strcasecmp() to compare two digest strings case
-insensitively and addressing this case.
-
-Upstream-Status: Backport
-Signed-off-by: Sergey Popovich <popovich_sergei@mail.ua>
----
- src/update.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/update.c b/src/update.c
-index 8588f38..3cc6b67 100644
---- a/src/update.c
-+++ b/src/update.c
-@@ -187,7 +187,7 @@ static bool nvdcve_data_ok(const char *meta, const char *data)
-                 snprintf(&csum_data[idx], len, "%02hhx", digest[i]);
-         }
- 
--        ret = streq(csum_meta, csum_data);
-+        ret = !strcasecmp(csum_meta, csum_data);
- 
- err_unmap:
-         munmap(buffer, length);
--- 
-2.11.0
-
diff --git a/poky/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch b/poky/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch
deleted file mode 100644
index 0774ad946..000000000
--- a/poky/meta/recipes-devtools/cve-check-tool/files/check-for-malloc_trim-before-using-it.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From ce64633b9733e962b8d8482244301f614d8b5845 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Mon, 22 Aug 2016 22:54:24 -0700
-Subject: [PATCH] Check for malloc_trim before using it
-
-malloc_trim is gnu specific and not all libc
-implement it, threfore write a configure check
-to poke for it first and use the define to
-guard its use.
-
-Helps in compiling on musl based systems
-
-Signed-off-by: Khem Raj <raj.khem@gmail.com>
----
-Upstream-Status: Submitted [https://github.com/ikeydoherty/cve-check-tool/pull/48]
- configure.ac | 2 ++
- src/core.c   | 4 ++--
- 2 files changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index d3b66ce..79c3542 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -19,6 +19,8 @@ m4_define([json_required_version], [0.16.0])
- m4_define([openssl_required_version],[1.0.0])
- # TODO: Set minimum sqlite
- 
-+AC_CHECK_FUNCS_ONCE(malloc_trim)
-+
- PKG_CHECK_MODULES(CVE_CHECK_TOOL,
-                  [
-                   glib-2.0 >= glib_required_version,
-diff --git a/src/core.c b/src/core.c
-index 6263031..0d5df29 100644
---- a/src/core.c
-+++ b/src/core.c
-@@ -498,9 +498,9 @@ bool cve_db_load(CveDB *self, const char *fname)
-         }
- 
-         b = true;
--
-+#ifdef HAVE_MALLOC_TRIM
-         malloc_trim(0);
--
-+#endif
-         xmlFreeTextReader(r);
-         if (fd) {
-                 close(fd);
--- 
-2.9.3
-