diff options
Diffstat (limited to 'meta-security')
23 files changed, 838 insertions, 325 deletions
diff --git a/meta-security/classes/dm-verity-img.bbclass b/meta-security/classes/dm-verity-img.bbclass index a0950dabd..0b6d053a8 100644 --- a/meta-security/classes/dm-verity-img.bbclass +++ b/meta-security/classes/dm-verity-img.bbclass @@ -22,6 +22,9 @@ # is stored where it can be installed into associated initramfs rootfs. STAGING_VERITY_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/dm-verity" +# Define the data block size to use in veritysetup. +DM_VERITY_IMAGE_DATA_BLOCK_SIZE ?= "1024" + # Process the output from veritysetup and generate the corresponding .env # file. The output from veritysetup is not very machine-friendly so we need to # convert it to some better format. Let's drop the first line (doesn't contain @@ -57,7 +60,7 @@ verity_setup() { # Let's drop the first line of output (doesn't contain any useful info) # and feed the rest to another function. - veritysetup --data-block-size=1024 --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity + veritysetup --data-block-size=${DM_VERITY_IMAGE_DATA_BLOCK_SIZE} --hash-offset=$SIZE format $OUTPUT $OUTPUT | tail -n +2 | process_verity } VERITY_TYPES = "ext2.verity ext3.verity ext4.verity btrfs.verity" diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/cryptoki.patch b/meta-security/meta-parsec/recipes-parsec/parsec-service/files/cryptoki.patch deleted file mode 100644 index c23447967..000000000 --- a/meta-security/meta-parsec/recipes-parsec/parsec-service/files/cryptoki.patch +++ /dev/null @@ -1,18 +0,0 @@ - -Use cryptoki v0.1.1 which supports the "generate-bindings" feature -required for building Parsec service 0.7.0 in Yocto. - -Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> -Upstream-Status: Submitted - ---- a/Cargo.toml 2021-04-01 10:29:50.333687763 +0100 -+++ b/Cargo.toml 2021-04-01 10:27:13.051860002 +0100 -@@ -37,7 +37,7 @@ - version = "1.3.1" - - [dependencies.cryptoki] --version = "0.1.0" -+version = "0.1.1" - features = ["psa-crypto-conversions"] - optional = true - diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.inc b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.inc deleted file mode 100644 index 59a47f92a..000000000 --- a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.inc +++ /dev/null @@ -1,147 +0,0 @@ -# This file is created from parsec-service repository Cargo.lock using cargo-bitbake tool - -SRC_URI += " \ - crate://crates.io/aho-corasick/0.7.15 \ - crate://crates.io/ansi_term/0.11.0 \ - crate://crates.io/anyhow/1.0.38 \ - crate://crates.io/atty/0.2.14 \ - crate://crates.io/autocfg/1.0.1 \ - crate://crates.io/base64/0.12.3 \ - crate://crates.io/base64/0.13.0 \ - crate://crates.io/bincode/1.3.2 \ - crate://crates.io/bindgen/0.56.0 \ - crate://crates.io/bindgen/0.57.0 \ - crate://crates.io/bitfield/0.13.2 \ - crate://crates.io/bitflags/1.2.1 \ - crate://crates.io/byteorder/1.3.4 \ - crate://crates.io/bytes/0.5.6 \ - crate://crates.io/bytes/1.0.1 \ - crate://crates.io/cc/1.0.67 \ - crate://crates.io/cexpr/0.4.0 \ - crate://crates.io/cfg-if/1.0.0 \ - crate://crates.io/clang-sys/1.1.1 \ - crate://crates.io/clap/2.33.3 \ - crate://crates.io/cmake/0.1.45 \ - crate://crates.io/cryptoauthlib-sys/0.1.0 \ - crate://crates.io/cryptoki-sys/0.1.1 \ - crate://crates.io/cryptoki/0.1.1 \ - crate://crates.io/derivative/2.2.0 \ - crate://crates.io/either/1.6.1 \ - crate://crates.io/enumflags2/0.6.4 \ - crate://crates.io/enumflags2_derive/0.6.4 \ - crate://crates.io/env_logger/0.8.3 \ - crate://crates.io/fixedbitset/0.2.0 \ - crate://crates.io/getrandom/0.2.2 \ - crate://crates.io/glob/0.3.0 \ - crate://crates.io/hashbrown/0.9.1 \ - crate://crates.io/heck/0.3.2 \ - crate://crates.io/hermit-abi/0.1.18 \ - crate://crates.io/hex/0.4.3 \ - crate://crates.io/hostname-validator/1.0.0 \ - crate://crates.io/humantime/2.1.0 \ - crate://crates.io/indexmap/1.6.2 \ - crate://crates.io/itertools/0.8.2 \ - crate://crates.io/itertools/0.9.0 \ - crate://crates.io/lazy_static/1.4.0 \ - crate://crates.io/lazycell/1.3.0 \ - crate://crates.io/libc/0.2.89 \ - crate://crates.io/libloading/0.7.0 \ - crate://crates.io/log/0.4.14 \ - crate://crates.io/mbox/0.5.0 \ - crate://crates.io/memchr/2.3.4 \ - crate://crates.io/multimap/0.8.3 \ - crate://crates.io/nom/5.1.2 \ - crate://crates.io/num-bigint/0.3.2 \ - crate://crates.io/num-complex/0.3.1 \ - crate://crates.io/num-derive/0.3.3 \ - crate://crates.io/num-integer/0.1.44 \ - crate://crates.io/num-iter/0.1.42 \ - crate://crates.io/num-rational/0.3.2 \ - crate://crates.io/num-traits/0.2.14 \ - crate://crates.io/num/0.3.1 \ - crate://crates.io/num_cpus/1.13.0 \ - crate://crates.io/oid/0.1.1 \ - crate://crates.io/parsec-interface/0.24.0 \ - crate://crates.io/peeking_take_while/0.1.2 \ - crate://crates.io/petgraph/0.5.1 \ - crate://crates.io/picky-asn1-der/0.2.4 \ - crate://crates.io/picky-asn1-x509/0.4.0 \ - crate://crates.io/picky-asn1/0.3.1 \ - crate://crates.io/pkg-config/0.3.19 \ - crate://crates.io/ppv-lite86/0.2.10 \ - crate://crates.io/proc-macro-error-attr/1.0.4 \ - crate://crates.io/proc-macro-error/1.0.4 \ - crate://crates.io/proc-macro2/1.0.24 \ - crate://crates.io/prost-build/0.6.1 \ - crate://crates.io/prost-build/0.7.0 \ - crate://crates.io/prost-derive/0.6.1 \ - crate://crates.io/prost-derive/0.7.0 \ - crate://crates.io/prost-types/0.6.1 \ - crate://crates.io/prost-types/0.7.0 \ - crate://crates.io/prost/0.6.1 \ - crate://crates.io/prost/0.7.0 \ - crate://crates.io/psa-crypto-sys/0.8.0 \ - crate://crates.io/psa-crypto/0.8.0 \ - crate://crates.io/quote/1.0.9 \ - crate://crates.io/rand/0.8.3 \ - crate://crates.io/rand_chacha/0.3.0 \ - crate://crates.io/rand_core/0.6.2 \ - crate://crates.io/rand_hc/0.3.0 \ - crate://crates.io/redox_syscall/0.2.5 \ - crate://crates.io/regex-syntax/0.6.23 \ - crate://crates.io/regex/1.4.5 \ - crate://crates.io/remove_dir_all/0.5.3 \ - crate://crates.io/rust-cryptoauthlib/0.1.0 \ - crate://crates.io/rustc-hash/1.1.0 \ - crate://crates.io/rustc_version/0.2.3 \ - crate://crates.io/same-file/1.0.6 \ - crate://crates.io/sd-notify/0.2.0 \ - crate://crates.io/secrecy/0.7.0 \ - crate://crates.io/semver-parser/0.7.0 \ - crate://crates.io/semver/0.9.0 \ - crate://crates.io/serde/1.0.124 \ - crate://crates.io/serde_bytes/0.11.5 \ - crate://crates.io/serde_derive/1.0.124 \ - crate://crates.io/shlex/0.1.1 \ - crate://crates.io/signal-hook-registry/1.3.0 \ - crate://crates.io/signal-hook/0.3.7 \ - crate://crates.io/stable_deref_trait/1.2.0 \ - crate://crates.io/strsim/0.8.0 \ - crate://crates.io/structopt-derive/0.4.14 \ - crate://crates.io/structopt/0.3.21 \ - crate://crates.io/strum_macros/0.19.4 \ - crate://crates.io/syn/1.0.64 \ - crate://crates.io/synstructure/0.12.4 \ - crate://crates.io/tempfile/3.2.0 \ - crate://crates.io/termcolor/1.1.2 \ - crate://crates.io/textwrap/0.11.0 \ - crate://crates.io/thiserror-impl/1.0.24 \ - crate://crates.io/thiserror/1.0.24 \ - crate://crates.io/threadpool/1.8.1 \ - crate://crates.io/toml/0.5.8 \ - crate://crates.io/tss-esapi-sys/0.1.0 \ - crate://crates.io/tss-esapi/5.0.0 \ - crate://crates.io/unicode-segmentation/1.7.1 \ - crate://crates.io/unicode-width/0.1.8 \ - crate://crates.io/unicode-xid/0.2.1 \ - crate://crates.io/users/0.11.0 \ - crate://crates.io/uuid/0.8.2 \ - crate://crates.io/vec_map/0.8.2 \ - crate://crates.io/version/3.0.0 \ - crate://crates.io/version_check/0.9.3 \ - crate://crates.io/walkdir/2.3.1 \ - crate://crates.io/wasi/0.10.2+wasi-snapshot-preview1 \ - crate://crates.io/which/3.1.1 \ - crate://crates.io/which/4.0.2 \ - crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \ - crate://crates.io/winapi-util/0.1.5 \ - crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \ - crate://crates.io/winapi/0.3.9 \ - crate://crates.io/zeroize/1.2.0 \ - crate://crates.io/zeroize_derive/1.0.1 \ - file://cryptoki.patch \ -" - -LIC_FILES_CHKSUM = " \ - file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57 \ -" diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.bb b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.8.1.bb index 5f7a99b42..b8bfa98ac 100644 --- a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.7.0.bb +++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.8.1.bb @@ -10,9 +10,18 @@ SRC_URI += "crate://crates.io/parsec-service/${PV} \ file://parsec-tmpfiles.conf \ " -DEPENDS = "tpm2-tss clang-native" - -CARGO_BUILD_FLAGS += " --features all-providers,cryptoki/generate-bindings,tss-esapi/generate-bindings" +DEPENDS = "clang-native" + +PACKAGECONFIG ??= "TPM PKCS11 MBED-CRYPTO CRYPTOAUTHLIB" +PACKAGECONFIG[ALL] = "all-providers,,tpm2-tss libts,libts" +PACKAGECONFIG[TPM] = "tpm-provider,,tpm2-tss" +PACKAGECONFIG[PKCS11] = "pkcs11-provider," +PACKAGECONFIG[MBED-CRYPTO] = "mbed-crypto-provider," +PACKAGECONFIG[CRYPTOAUTHLIB] = "cryptoauthlib-provider," +PACKAGECONFIG[TS] = "trusted-service-provider,,libts,libts" + +PARSEC_PROVIDERS = "${@d.getVar('PACKAGECONFIG_CONFARGS',True).replace(' ', ',')}" +CARGO_BUILD_FLAGS += " --features ${PARSEC_PROVIDERS},cryptoki/generate-bindings,tss-esapi/generate-bindings" inherit systemd SYSTEMD_SERVICE:${PN} = "parsec.service" diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.8.1.inc b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.8.1.inc new file mode 100644 index 000000000..fd88e8717 --- /dev/null +++ b/meta-security/meta-parsec/recipes-parsec/parsec-service/parsec-service_0.8.1.inc @@ -0,0 +1,246 @@ +# This file is created from parsec-service repository Cargo.lock using cargo-bitbake tool + +SRC_URI += " \ + crate://crates.io/addr2line/0.15.2 \ + crate://crates.io/adler/1.0.2 \ + crate://crates.io/aho-corasick/0.7.15 \ + crate://crates.io/ansi_term/0.11.0 \ + crate://crates.io/anyhow/1.0.41 \ + crate://crates.io/arrayvec/0.5.2 \ + crate://crates.io/atty/0.2.14 \ + crate://crates.io/autocfg/1.0.1 \ + crate://crates.io/backtrace/0.3.59 \ + crate://crates.io/base64/0.12.3 \ + crate://crates.io/base64/0.13.0 \ + crate://crates.io/bincode/1.3.3 \ + crate://crates.io/bindgen/0.56.0 \ + crate://crates.io/bindgen/0.57.0 \ + crate://crates.io/bitfield/0.13.2 \ + crate://crates.io/bitflags/1.2.1 \ + crate://crates.io/bitvec/0.19.5 \ + crate://crates.io/boringssl-src/0.3.0+688fc5c \ + crate://crates.io/bumpalo/3.7.0 \ + crate://crates.io/bytes/0.5.6 \ + crate://crates.io/bytes/1.0.1 \ + crate://crates.io/cc/1.0.68 \ + crate://crates.io/cexpr/0.4.0 \ + crate://crates.io/cfg-if/1.0.0 \ + crate://crates.io/chrono/0.4.19 \ + crate://crates.io/clang-sys/1.2.0 \ + crate://crates.io/clap/2.33.3 \ + crate://crates.io/cmake/0.1.45 \ + crate://crates.io/const-oid/0.6.0 \ + crate://crates.io/cryptoauthlib-sys/0.2.0 \ + crate://crates.io/cryptoki-sys/0.1.2 \ + crate://crates.io/cryptoki/0.2.0 \ + crate://crates.io/data-encoding/2.3.2 \ + crate://crates.io/der-oid-macro/0.4.0 \ + crate://crates.io/der-parser/5.1.0 \ + crate://crates.io/der/0.4.0 \ + crate://crates.io/derivative/2.2.0 \ + crate://crates.io/either/1.6.1 \ + crate://crates.io/enumflags2/0.6.4 \ + crate://crates.io/enumflags2_derive/0.6.4 \ + crate://crates.io/env_logger/0.8.4 \ + crate://crates.io/failure/0.1.8 \ + crate://crates.io/failure_derive/0.1.8 \ + crate://crates.io/fixedbitset/0.2.0 \ + crate://crates.io/form_urlencoded/1.0.1 \ + crate://crates.io/funty/1.1.0 \ + crate://crates.io/futures-channel/0.3.15 \ + crate://crates.io/futures-core/0.3.15 \ + crate://crates.io/futures-executor/0.3.15 \ + crate://crates.io/futures-io/0.3.15 \ + crate://crates.io/futures-macro/0.3.15 \ + crate://crates.io/futures-sink/0.3.15 \ + crate://crates.io/futures-task/0.3.15 \ + crate://crates.io/futures-util/0.3.15 \ + crate://crates.io/futures/0.3.15 \ + crate://crates.io/generic-array/0.14.4 \ + crate://crates.io/getrandom/0.2.3 \ + crate://crates.io/gimli/0.24.0 \ + crate://crates.io/glob/0.3.0 \ + crate://crates.io/grpcio-compiler/0.7.0 \ + crate://crates.io/grpcio-sys/0.9.0+1.38.0 \ + crate://crates.io/grpcio/0.9.0 \ + crate://crates.io/hamming/0.1.3 \ + crate://crates.io/hashbrown/0.9.1 \ + crate://crates.io/heck/0.3.3 \ + crate://crates.io/hermit-abi/0.1.18 \ + crate://crates.io/hex/0.4.3 \ + crate://crates.io/hostname-validator/1.1.0 \ + crate://crates.io/humantime/2.1.0 \ + crate://crates.io/idna/0.2.3 \ + crate://crates.io/indexmap/1.6.2 \ + crate://crates.io/instant/0.1.9 \ + crate://crates.io/itertools/0.8.2 \ + crate://crates.io/itertools/0.9.0 \ + crate://crates.io/itoa/0.4.7 \ + crate://crates.io/js-sys/0.3.51 \ + crate://crates.io/jsonwebkey/0.3.2 \ + crate://crates.io/jsonwebtoken/7.2.0 \ + crate://crates.io/lazy_static/1.4.0 \ + crate://crates.io/lazycell/1.3.0 \ + crate://crates.io/lexical-core/0.7.6 \ + crate://crates.io/libc/0.2.97 \ + crate://crates.io/libloading/0.7.0 \ + crate://crates.io/libz-sys/1.1.3 \ + crate://crates.io/lock_api/0.4.4 \ + crate://crates.io/log/0.4.14 \ + crate://crates.io/matches/0.1.8 \ + crate://crates.io/mbox/0.5.0 \ + crate://crates.io/memchr/2.3.4 \ + crate://crates.io/miniz_oxide/0.4.4 \ + crate://crates.io/multimap/0.8.3 \ + crate://crates.io/nom/5.1.2 \ + crate://crates.io/nom/6.2.0 \ + crate://crates.io/num-bigint/0.2.6 \ + crate://crates.io/num-bigint/0.3.2 \ + crate://crates.io/num-bigint/0.4.0 \ + crate://crates.io/num-complex/0.3.1 \ + crate://crates.io/num-derive/0.3.3 \ + crate://crates.io/num-integer/0.1.44 \ + crate://crates.io/num-iter/0.1.42 \ + crate://crates.io/num-rational/0.3.2 \ + crate://crates.io/num-traits/0.2.14 \ + crate://crates.io/num/0.3.1 \ + crate://crates.io/num_cpus/1.13.0 \ + crate://crates.io/object/0.24.0 \ + crate://crates.io/oid-registry/0.1.3 \ + crate://crates.io/oid/0.1.1 \ + crate://crates.io/once_cell/1.8.0 \ + crate://crates.io/parking_lot/0.11.1 \ + crate://crates.io/parking_lot_core/0.8.3 \ + crate://crates.io/parsec-interface/0.25.0 \ + crate://crates.io/peeking_take_while/0.1.2 \ + crate://crates.io/pem/0.8.3 \ + crate://crates.io/percent-encoding/2.1.0 \ + crate://crates.io/petgraph/0.5.1 \ + crate://crates.io/picky-asn1-der/0.2.4 \ + crate://crates.io/picky-asn1-x509/0.4.0 \ + crate://crates.io/picky-asn1/0.3.1 \ + crate://crates.io/pin-project-lite/0.2.6 \ + crate://crates.io/pin-utils/0.1.0 \ + crate://crates.io/pkcs8/0.7.0 \ + crate://crates.io/pkg-config/0.3.19 \ + crate://crates.io/ppv-lite86/0.2.10 \ + crate://crates.io/primal-bit/0.3.0 \ + crate://crates.io/primal-check/0.3.1 \ + crate://crates.io/primal-estimate/0.3.1 \ + crate://crates.io/primal-sieve/0.3.1 \ + crate://crates.io/primal/0.3.0 \ + crate://crates.io/proc-macro-error-attr/1.0.4 \ + crate://crates.io/proc-macro-error/1.0.4 \ + crate://crates.io/proc-macro-hack/0.5.19 \ + crate://crates.io/proc-macro-nested/0.1.7 \ + crate://crates.io/proc-macro2/1.0.27 \ + crate://crates.io/prost-build/0.7.0 \ + crate://crates.io/prost-derive/0.6.1 \ + crate://crates.io/prost-derive/0.7.0 \ + crate://crates.io/prost-types/0.7.0 \ + crate://crates.io/prost/0.6.1 \ + crate://crates.io/prost/0.7.0 \ + crate://crates.io/protobuf-codegen/2.24.1 \ + crate://crates.io/protobuf/2.24.1 \ + crate://crates.io/protoc-grpcio/3.0.0 \ + crate://crates.io/protoc/2.24.1 \ + crate://crates.io/psa-crypto-sys/0.9.0 \ + crate://crates.io/psa-crypto/0.9.0 \ + crate://crates.io/quote/1.0.9 \ + crate://crates.io/radium/0.5.3 \ + crate://crates.io/rand/0.8.4 \ + crate://crates.io/rand_chacha/0.3.1 \ + crate://crates.io/rand_core/0.6.3 \ + crate://crates.io/rand_hc/0.3.1 \ + crate://crates.io/redox_syscall/0.2.9 \ + crate://crates.io/regex-syntax/0.6.25 \ + crate://crates.io/regex/1.4.6 \ + crate://crates.io/remove_dir_all/0.5.3 \ + crate://crates.io/ring/0.16.20 \ + crate://crates.io/rust-cryptoauthlib/0.4.0 \ + crate://crates.io/rustc-demangle/0.1.20 \ + crate://crates.io/rustc-hash/1.1.0 \ + crate://crates.io/rustc_version/0.2.3 \ + crate://crates.io/rusticata-macros/3.0.1 \ + crate://crates.io/rustversion/1.0.5 \ + crate://crates.io/ryu/1.0.5 \ + crate://crates.io/same-file/1.0.6 \ + crate://crates.io/scopeguard/1.1.0 \ + crate://crates.io/sd-notify/0.2.0 \ + crate://crates.io/secrecy/0.7.0 \ + crate://crates.io/semver-parser/0.7.0 \ + crate://crates.io/semver/0.9.0 \ + crate://crates.io/serde/1.0.126 \ + crate://crates.io/serde_bytes/0.11.5 \ + crate://crates.io/serde_derive/1.0.126 \ + crate://crates.io/serde_json/1.0.64 \ + crate://crates.io/shlex/0.1.1 \ + crate://crates.io/signal-hook-registry/1.4.0 \ + crate://crates.io/signal-hook/0.3.9 \ + crate://crates.io/simple_asn1/0.4.1 \ + crate://crates.io/simple_asn1/0.5.3 \ + crate://crates.io/slab/0.4.3 \ + crate://crates.io/smallvec/1.6.1 \ + crate://crates.io/spiffe/0.1.1 \ + crate://crates.io/spin/0.5.2 \ + crate://crates.io/spki/0.4.0 \ + crate://crates.io/stable_deref_trait/1.2.0 \ + crate://crates.io/static_assertions/1.1.0 \ + crate://crates.io/strsim/0.8.0 \ + crate://crates.io/structopt-derive/0.4.14 \ + crate://crates.io/structopt/0.3.21 \ + crate://crates.io/strum_macros/0.19.4 \ + crate://crates.io/syn/1.0.73 \ + crate://crates.io/synstructure/0.12.4 \ + crate://crates.io/tap/1.0.1 \ + crate://crates.io/target-lexicon/0.12.0 \ + crate://crates.io/tempfile/3.2.0 \ + crate://crates.io/termcolor/1.1.2 \ + crate://crates.io/textwrap/0.11.0 \ + crate://crates.io/thiserror-impl/1.0.25 \ + crate://crates.io/thiserror/1.0.25 \ + crate://crates.io/threadpool/1.8.1 \ + crate://crates.io/time/0.1.44 \ + crate://crates.io/tinyvec/1.2.0 \ + crate://crates.io/tinyvec_macros/0.1.0 \ + crate://crates.io/toml/0.5.8 \ + crate://crates.io/tss-esapi-sys/0.2.0 \ + crate://crates.io/tss-esapi/7.0.0-alpha.1 \ + crate://crates.io/typenum/1.13.0 \ + crate://crates.io/unicode-bidi/0.3.5 \ + crate://crates.io/unicode-normalization/0.1.19 \ + crate://crates.io/unicode-segmentation/1.7.1 \ + crate://crates.io/unicode-width/0.1.8 \ + crate://crates.io/unicode-xid/0.2.2 \ + crate://crates.io/untrusted/0.7.1 \ + crate://crates.io/url/2.2.2 \ + crate://crates.io/users/0.11.0 \ + crate://crates.io/uuid/0.8.2 \ + crate://crates.io/vcpkg/0.2.15 \ + crate://crates.io/vec_map/0.8.2 \ + crate://crates.io/version/3.0.0 \ + crate://crates.io/version_check/0.9.3 \ + crate://crates.io/walkdir/2.3.2 \ + crate://crates.io/wasi/0.10.0+wasi-snapshot-preview1 \ + crate://crates.io/wasm-bindgen-backend/0.2.74 \ + crate://crates.io/wasm-bindgen-macro-support/0.2.74 \ + crate://crates.io/wasm-bindgen-macro/0.2.74 \ + crate://crates.io/wasm-bindgen-shared/0.2.74 \ + crate://crates.io/wasm-bindgen/0.2.74 \ + crate://crates.io/web-sys/0.3.51 \ + crate://crates.io/which/3.1.1 \ + crate://crates.io/which/4.1.0 \ + crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \ + crate://crates.io/winapi-util/0.1.5 \ + crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \ + crate://crates.io/winapi/0.3.9 \ + crate://crates.io/wyz/0.2.0 \ + crate://crates.io/x509-parser/0.9.2 \ + crate://crates.io/yasna/0.3.2 \ + crate://crates.io/zeroize/1.3.0 \ + crate://crates.io/zeroize_derive/1.1.0 \ +" + +LIC_FILES_CHKSUM = " \ + file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57 \ +" diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.3.0.inc b/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.3.0.inc deleted file mode 100644 index 9560dcff1..000000000 --- a/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.3.0.inc +++ /dev/null @@ -1,127 +0,0 @@ -# This file is created from parsec-tool repository Cargo.lock using cargo-bitbake tool - -SRC_URI += " \ - crate://crates.io/aho-corasick/0.7.15 \ - crate://crates.io/ansi_term/0.11.0 \ - crate://crates.io/ansi_term/0.12.1 \ - crate://crates.io/anyhow/1.0.38 \ - crate://crates.io/atty/0.2.14 \ - crate://crates.io/autocfg/1.0.1 \ - crate://crates.io/base64/0.13.0 \ - crate://crates.io/bincode/1.3.1 \ - crate://crates.io/bitflags/1.2.1 \ - crate://crates.io/block-buffer/0.9.0 \ - crate://crates.io/byteorder/1.4.2 \ - crate://crates.io/bytes/0.5.6 \ - crate://crates.io/cc/1.0.66 \ - crate://crates.io/cfg-if/1.0.0 \ - crate://crates.io/clap/2.33.3 \ - crate://crates.io/clap/3.0.0-beta.2 \ - crate://crates.io/clap_derive/3.0.0-beta.2 \ - crate://crates.io/cmake/0.1.45 \ - crate://crates.io/cpuid-bool/0.1.2 \ - crate://crates.io/derivative/2.2.0 \ - crate://crates.io/digest/0.9.0 \ - crate://crates.io/either/1.6.1 \ - crate://crates.io/env_logger/0.8.3 \ - crate://crates.io/fixedbitset/0.2.0 \ - crate://crates.io/form_urlencoded/1.0.0 \ - crate://crates.io/generic-array/0.14.4 \ - crate://crates.io/getrandom/0.2.2 \ - crate://crates.io/hashbrown/0.9.1 \ - crate://crates.io/heck/0.3.2 \ - crate://crates.io/hermit-abi/0.1.18 \ - crate://crates.io/humantime/2.1.0 \ - crate://crates.io/idna/0.2.1 \ - crate://crates.io/indexmap/1.6.1 \ - crate://crates.io/itertools/0.8.2 \ - crate://crates.io/lazy_static/1.4.0 \ - crate://crates.io/libc/0.2.86 \ - crate://crates.io/log/0.4.14 \ - crate://crates.io/matches/0.1.8 \ - crate://crates.io/memchr/2.3.4 \ - crate://crates.io/multimap/0.8.2 \ - crate://crates.io/num-bigint/0.3.1 \ - crate://crates.io/num-complex/0.3.1 \ - crate://crates.io/num-derive/0.3.3 \ - crate://crates.io/num-integer/0.1.44 \ - crate://crates.io/num-iter/0.1.42 \ - crate://crates.io/num-rational/0.3.2 \ - crate://crates.io/num-traits/0.2.14 \ - crate://crates.io/num/0.3.1 \ - crate://crates.io/oid/0.1.1 \ - crate://crates.io/once_cell/1.5.2 \ - crate://crates.io/opaque-debug/0.3.0 \ - crate://crates.io/os_str_bytes/2.4.0 \ - crate://crates.io/parsec-client/0.12.0 \ - crate://crates.io/parsec-interface/0.24.0 \ - crate://crates.io/pem/0.8.3 \ - crate://crates.io/percent-encoding/2.1.0 \ - crate://crates.io/petgraph/0.5.1 \ - crate://crates.io/picky-asn1-der/0.2.4 \ - crate://crates.io/picky-asn1/0.3.1 \ - crate://crates.io/ppv-lite86/0.2.10 \ - crate://crates.io/proc-macro-error-attr/1.0.4 \ - crate://crates.io/proc-macro-error/1.0.4 \ - crate://crates.io/proc-macro2/1.0.24 \ - crate://crates.io/prost-build/0.6.1 \ - crate://crates.io/prost-derive/0.6.1 \ - crate://crates.io/prost-types/0.6.1 \ - crate://crates.io/prost/0.6.1 \ - crate://crates.io/psa-crypto-sys/0.8.0 \ - crate://crates.io/psa-crypto/0.8.0 \ - crate://crates.io/quote/1.0.9 \ - crate://crates.io/rand/0.8.3 \ - crate://crates.io/rand_chacha/0.3.0 \ - crate://crates.io/rand_core/0.6.2 \ - crate://crates.io/rand_hc/0.3.0 \ - crate://crates.io/redox_syscall/0.2.5 \ - crate://crates.io/regex-syntax/0.6.22 \ - crate://crates.io/regex/1.4.3 \ - crate://crates.io/remove_dir_all/0.5.3 \ - crate://crates.io/same-file/1.0.6 \ - crate://crates.io/secrecy/0.7.0 \ - crate://crates.io/serde/1.0.123 \ - crate://crates.io/serde_bytes/0.11.5 \ - crate://crates.io/serde_derive/1.0.123 \ - crate://crates.io/sha2/0.9.3 \ - crate://crates.io/strsim/0.10.0 \ - crate://crates.io/strsim/0.8.0 \ - crate://crates.io/structopt-derive/0.4.14 \ - crate://crates.io/structopt/0.3.21 \ - crate://crates.io/syn/1.0.60 \ - crate://crates.io/synstructure/0.12.4 \ - crate://crates.io/tempfile/3.2.0 \ - crate://crates.io/termcolor/1.1.2 \ - crate://crates.io/textwrap/0.11.0 \ - crate://crates.io/textwrap/0.12.1 \ - crate://crates.io/thiserror-impl/1.0.23 \ - crate://crates.io/thiserror/1.0.23 \ - crate://crates.io/thread_local/1.1.3 \ - crate://crates.io/tinyvec/1.1.1 \ - crate://crates.io/tinyvec_macros/0.1.0 \ - crate://crates.io/typenum/1.12.0 \ - crate://crates.io/unicode-bidi/0.3.4 \ - crate://crates.io/unicode-normalization/0.1.17 \ - crate://crates.io/unicode-segmentation/1.7.1 \ - crate://crates.io/unicode-width/0.1.8 \ - crate://crates.io/unicode-xid/0.2.1 \ - crate://crates.io/url/2.2.0 \ - crate://crates.io/users/0.10.0 \ - crate://crates.io/uuid/0.8.2 \ - crate://crates.io/vec_map/0.8.2 \ - crate://crates.io/version_check/0.9.2 \ - crate://crates.io/walkdir/2.3.1 \ - crate://crates.io/wasi/0.10.2+wasi-snapshot-preview1 \ - crate://crates.io/which/3.1.1 \ - crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \ - crate://crates.io/winapi-util/0.1.5 \ - crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \ - crate://crates.io/winapi/0.3.9 \ - crate://crates.io/zeroize/1.2.0 \ - crate://crates.io/zeroize_derive/1.0.1 \ -" - -LIC_FILES_CHKSUM = " \ - file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57 \ -" diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.3.0.bb b/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.4.0.bb index 881f8d896..4b053b9ca 100644 --- a/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.3.0.bb +++ b/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.4.0.bb @@ -7,9 +7,12 @@ inherit cargo SRC_URI += "crate://crates.io/parsec-tool/${PV} \ " +RDEPENDS:${PN} = "openssl-bin" + do_install() { install -d ${D}/${bindir} install -m 755 "${B}/target/${TARGET_SYS}/release/parsec-tool" "${D}${bindir}/parsec-tool" + install -m 755 "${S}/tests/parsec-cli-tests.sh" "${D}${bindir}/parsec-cli-tests.sh" } require parsec-tool_${PV}.inc diff --git a/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.4.0.inc b/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.4.0.inc new file mode 100644 index 000000000..e70611255 --- /dev/null +++ b/meta-security/meta-parsec/recipes-parsec/parsec-tool/parsec-tool_0.4.0.inc @@ -0,0 +1,216 @@ +# This file is created from parsec-tool repository Cargo.lock using cargo-bitbake tool + +SRC_URI += " \ + crate://crates.io/addr2line/0.15.2 \ + crate://crates.io/adler/1.0.2 \ + crate://crates.io/aho-corasick/0.7.15 \ + crate://crates.io/ansi_term/0.11.0 \ + crate://crates.io/ansi_term/0.12.1 \ + crate://crates.io/anyhow/1.0.42 \ + crate://crates.io/arrayvec/0.5.2 \ + crate://crates.io/atty/0.2.14 \ + crate://crates.io/autocfg/1.0.1 \ + crate://crates.io/backtrace/0.3.59 \ + crate://crates.io/base64/0.12.3 \ + crate://crates.io/base64/0.13.0 \ + crate://crates.io/bincode/1.3.3 \ + crate://crates.io/bindgen/0.57.0 \ + crate://crates.io/bitflags/1.2.1 \ + crate://crates.io/bitvec/0.19.5 \ + crate://crates.io/block-buffer/0.9.0 \ + crate://crates.io/boringssl-src/0.3.0+688fc5c \ + crate://crates.io/bumpalo/3.7.0 \ + crate://crates.io/bytes/0.5.6 \ + crate://crates.io/cc/1.0.69 \ + crate://crates.io/cexpr/0.4.0 \ + crate://crates.io/cfg-if/1.0.0 \ + crate://crates.io/chrono/0.4.19 \ + crate://crates.io/clang-sys/1.2.0 \ + crate://crates.io/clap/2.33.3 \ + crate://crates.io/clap/3.0.0-beta.2 \ + crate://crates.io/clap_derive/3.0.0-beta.2 \ + crate://crates.io/cmake/0.1.45 \ + crate://crates.io/const-oid/0.6.0 \ + crate://crates.io/cpufeatures/0.1.5 \ + crate://crates.io/data-encoding/2.3.2 \ + crate://crates.io/der-oid-macro/0.4.0 \ + crate://crates.io/der-parser/5.1.2 \ + crate://crates.io/der/0.4.0 \ + crate://crates.io/derivative/2.2.0 \ + crate://crates.io/digest/0.9.0 \ + crate://crates.io/either/1.6.1 \ + crate://crates.io/env_logger/0.8.4 \ + crate://crates.io/failure/0.1.8 \ + crate://crates.io/failure_derive/0.1.8 \ + crate://crates.io/form_urlencoded/1.0.1 \ + crate://crates.io/funty/1.1.0 \ + crate://crates.io/futures-channel/0.3.16 \ + crate://crates.io/futures-core/0.3.16 \ + crate://crates.io/futures-executor/0.3.16 \ + crate://crates.io/futures-io/0.3.16 \ + crate://crates.io/futures-macro/0.3.16 \ + crate://crates.io/futures-sink/0.3.16 \ + crate://crates.io/futures-task/0.3.16 \ + crate://crates.io/futures-util/0.3.16 \ + crate://crates.io/futures/0.3.16 \ + crate://crates.io/generic-array/0.14.4 \ + crate://crates.io/getrandom/0.2.3 \ + crate://crates.io/gimli/0.24.0 \ + crate://crates.io/glob/0.3.0 \ + crate://crates.io/grpcio-compiler/0.7.0 \ + crate://crates.io/grpcio-sys/0.9.0+1.38.0 \ + crate://crates.io/grpcio/0.9.0 \ + crate://crates.io/hashbrown/0.11.2 \ + crate://crates.io/heck/0.3.3 \ + crate://crates.io/hermit-abi/0.1.19 \ + crate://crates.io/humantime/2.1.0 \ + crate://crates.io/idna/0.2.3 \ + crate://crates.io/indexmap/1.7.0 \ + crate://crates.io/instant/0.1.10 \ + crate://crates.io/itertools/0.8.2 \ + crate://crates.io/itoa/0.4.7 \ + crate://crates.io/js-sys/0.3.52 \ + crate://crates.io/jsonwebkey/0.3.2 \ + crate://crates.io/jsonwebtoken/7.2.0 \ + crate://crates.io/lazy_static/1.4.0 \ + crate://crates.io/lazycell/1.3.0 \ + crate://crates.io/lexical-core/0.7.6 \ + crate://crates.io/libc/0.2.102 \ + crate://crates.io/libloading/0.7.0 \ + crate://crates.io/libz-sys/1.1.3 \ + crate://crates.io/lock_api/0.4.4 \ + crate://crates.io/log/0.4.14 \ + crate://crates.io/matches/0.1.8 \ + crate://crates.io/memchr/2.3.4 \ + crate://crates.io/miniz_oxide/0.4.4 \ + crate://crates.io/nom/5.1.2 \ + crate://crates.io/nom/6.2.1 \ + crate://crates.io/num-bigint/0.2.6 \ + crate://crates.io/num-bigint/0.3.2 \ + crate://crates.io/num-bigint/0.4.0 \ + crate://crates.io/num-complex/0.3.1 \ + crate://crates.io/num-derive/0.3.3 \ + crate://crates.io/num-integer/0.1.44 \ + crate://crates.io/num-iter/0.1.42 \ + crate://crates.io/num-rational/0.3.2 \ + crate://crates.io/num-traits/0.2.14 \ + crate://crates.io/num/0.3.1 \ + crate://crates.io/object/0.24.0 \ + crate://crates.io/oid-registry/0.1.5 \ + crate://crates.io/oid/0.2.1 \ + crate://crates.io/once_cell/1.8.0 \ + crate://crates.io/opaque-debug/0.3.0 \ + crate://crates.io/os_str_bytes/2.4.0 \ + crate://crates.io/parking_lot/0.11.1 \ + crate://crates.io/parking_lot_core/0.8.3 \ + crate://crates.io/parsec-client/0.13.0 \ + crate://crates.io/parsec-interface/0.25.0 \ + crate://crates.io/peeking_take_while/0.1.2 \ + crate://crates.io/pem/0.8.3 \ + crate://crates.io/percent-encoding/2.1.0 \ + crate://crates.io/picky-asn1-der/0.2.5 \ + crate://crates.io/picky-asn1-x509/0.6.1 \ + crate://crates.io/picky-asn1/0.3.3 \ + crate://crates.io/pin-project-lite/0.2.7 \ + crate://crates.io/pin-utils/0.1.0 \ + crate://crates.io/pkcs8/0.7.5 \ + crate://crates.io/pkg-config/0.3.19 \ + crate://crates.io/ppv-lite86/0.2.10 \ + crate://crates.io/proc-macro-error-attr/1.0.4 \ + crate://crates.io/proc-macro-error/1.0.4 \ + crate://crates.io/proc-macro-hack/0.5.19 \ + crate://crates.io/proc-macro-nested/0.1.7 \ + crate://crates.io/proc-macro2/1.0.28 \ + crate://crates.io/prost-derive/0.6.1 \ + crate://crates.io/prost/0.6.1 \ + crate://crates.io/protobuf-codegen/2.24.1 \ + crate://crates.io/protobuf/2.24.1 \ + crate://crates.io/protoc-grpcio/3.0.0 \ + crate://crates.io/protoc/2.24.1 \ + crate://crates.io/psa-crypto-sys/0.9.0 \ + crate://crates.io/psa-crypto/0.9.0 \ + crate://crates.io/quote/1.0.9 \ + crate://crates.io/radium/0.5.3 \ + crate://crates.io/rand/0.8.4 \ + crate://crates.io/rand_chacha/0.3.1 \ + crate://crates.io/rand_core/0.6.3 \ + crate://crates.io/rand_hc/0.3.1 \ + crate://crates.io/redox_syscall/0.2.9 \ + crate://crates.io/regex-syntax/0.6.25 \ + crate://crates.io/regex/1.4.6 \ + crate://crates.io/remove_dir_all/0.5.3 \ + crate://crates.io/ring/0.16.20 \ + crate://crates.io/rustc-demangle/0.1.20 \ + crate://crates.io/rustc-hash/1.1.0 \ + crate://crates.io/rusticata-macros/3.1.0 \ + crate://crates.io/rustversion/1.0.5 \ + crate://crates.io/ryu/1.0.5 \ + crate://crates.io/same-file/1.0.6 \ + crate://crates.io/scopeguard/1.1.0 \ + crate://crates.io/secrecy/0.7.0 \ + crate://crates.io/serde/1.0.127 \ + crate://crates.io/serde_bytes/0.11.5 \ + crate://crates.io/serde_derive/1.0.127 \ + crate://crates.io/serde_json/1.0.66 \ + crate://crates.io/sha2/0.9.5 \ + crate://crates.io/shlex/0.1.1 \ + crate://crates.io/simple_asn1/0.4.1 \ + crate://crates.io/simple_asn1/0.5.4 \ + crate://crates.io/slab/0.4.3 \ + crate://crates.io/smallvec/1.6.1 \ + crate://crates.io/spiffe/0.1.1 \ + crate://crates.io/spin/0.5.2 \ + crate://crates.io/spki/0.4.0 \ + crate://crates.io/static_assertions/1.1.0 \ + crate://crates.io/strsim/0.10.0 \ + crate://crates.io/strsim/0.8.0 \ + crate://crates.io/structopt-derive/0.4.15 \ + crate://crates.io/structopt/0.3.22 \ + crate://crates.io/syn/1.0.74 \ + crate://crates.io/synstructure/0.12.5 \ + crate://crates.io/tap/1.0.1 \ + crate://crates.io/tempfile/3.2.0 \ + crate://crates.io/termcolor/1.1.2 \ + crate://crates.io/textwrap/0.11.0 \ + crate://crates.io/textwrap/0.12.1 \ + crate://crates.io/thiserror-impl/1.0.26 \ + crate://crates.io/thiserror/1.0.26 \ + crate://crates.io/time/0.1.44 \ + crate://crates.io/tinyvec/1.3.1 \ + crate://crates.io/tinyvec_macros/0.1.0 \ + crate://crates.io/typenum/1.13.0 \ + crate://crates.io/unicode-bidi/0.3.5 \ + crate://crates.io/unicode-normalization/0.1.19 \ + crate://crates.io/unicode-segmentation/1.8.0 \ + crate://crates.io/unicode-width/0.1.8 \ + crate://crates.io/unicode-xid/0.2.2 \ + crate://crates.io/untrusted/0.7.1 \ + crate://crates.io/url/2.2.2 \ + crate://crates.io/users/0.10.0 \ + crate://crates.io/uuid/0.8.2 \ + crate://crates.io/vcpkg/0.2.15 \ + crate://crates.io/vec_map/0.8.2 \ + crate://crates.io/version_check/0.9.3 \ + crate://crates.io/walkdir/2.3.2 \ + crate://crates.io/wasi/0.10.0+wasi-snapshot-preview1 \ + crate://crates.io/wasm-bindgen-backend/0.2.75 \ + crate://crates.io/wasm-bindgen-macro-support/0.2.75 \ + crate://crates.io/wasm-bindgen-macro/0.2.75 \ + crate://crates.io/wasm-bindgen-shared/0.2.75 \ + crate://crates.io/wasm-bindgen/0.2.75 \ + crate://crates.io/web-sys/0.3.52 \ + crate://crates.io/which/4.2.2 \ + crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \ + crate://crates.io/winapi-util/0.1.5 \ + crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \ + crate://crates.io/winapi/0.3.9 \ + crate://crates.io/wyz/0.2.0 \ + crate://crates.io/x509-parser/0.9.2 \ + crate://crates.io/yasna/0.3.2 \ + crate://crates.io/zeroize/1.3.0 \ + crate://crates.io/zeroize_derive/1.1.0 \ +" + +LIC_FILES_CHKSUM = " \ + file://LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57 \ +" diff --git a/meta-security/meta-tpm/recipes-tpm/libtpm/libtpm_0.8.2.bb b/meta-security/meta-tpm/recipes-tpm/libtpm/libtpm_0.8.7.bb index 9784aa115..95ba5c59c 100644 --- a/meta-security/meta-tpm/recipes-tpm/libtpm/libtpm_0.8.2.bb +++ b/meta-security/meta-tpm/recipes-tpm/libtpm/libtpm_0.8.7.bb @@ -2,7 +2,7 @@ SUMMARY = "LIBPM - Software TPM Library" LICENSE = "BSD-3-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=e73f0786a936da3814896df06ad225a9" -SRCREV = "f66a719eda0b492ea3ec7852421a9d98db0a0621" +SRCREV = "f6dd8f55eab4910131ec6a6a570dcd7951bd10e4" SRC_URI = "git://github.com/stefanberger/libtpms.git;branch=stable-0.8" PE = "1" diff --git a/meta-security/meta-tpm/recipes-tpm/tpm-quote-tools/tpm-quote-tools_1.0.4.bb b/meta-security/meta-tpm/recipes-tpm/tpm-quote-tools/tpm-quote-tools_1.0.4.bb index 8486d0016..53cf8ff11 100644 --- a/meta-security/meta-tpm/recipes-tpm/tpm-quote-tools/tpm-quote-tools_1.0.4.bb +++ b/meta-security/meta-tpm/recipes-tpm/tpm-quote-tools/tpm-quote-tools_1.0.4.bb @@ -15,9 +15,8 @@ LIC_FILES_CHKSUM = "file://COPYING;md5=8ec30b01163d242ecf07d9cd84e3611f" DEPENDS = "libtspi tpm-tools" -SRC_URI = "${SOURCEFORGE_MIRROR}/tpmquotetools/${PV}/${BP}.tar.gz" - -SRC_URI[md5sum] = "6e194f5bc534301bbaef53dc6d22c233" -SRC_URI[sha256sum] = "10dc4eade02635557a9496b388360844cd18e7864e2eb882f5e45ab2fa405ae2" +SRC_URI = "git://git.code.sf.net/p/tpmquotetools/tpm-quote-tools" +SRCREV = "4511874d5c9b4504bb96e94f8a14bd6c39a36295" +S = "${WORKDIR}/git" inherit autotools diff --git a/meta-security/meta-tpm/recipes-tpm/trousers/trousers_git.bb b/meta-security/meta-tpm/recipes-tpm/trousers/trousers_git.bb index a746103de..5e03b710e 100644 --- a/meta-security/meta-tpm/recipes-tpm/trousers/trousers_git.bb +++ b/meta-security/meta-tpm/recipes-tpm/trousers/trousers_git.bb @@ -1,5 +1,5 @@ SUMMARY = "TrouSerS - An open-source TCG Software Stack implementation." -LICENSE = "BSD" +LICENSE = "BSD-3-Clause" HOMEPAGE = "http://sourceforge.net/projects/trousers/" LIC_FILES_CHKSUM = "file://README;startline=3;endline=4;md5=2af28fbed0832e4d83a9e6dd68bb4413" SECTION = "security/tpm" diff --git a/meta-security/meta-tpm/recipes-tpm2/ibmswtpm2/ibmswtpm2_1661.bb b/meta-security/meta-tpm/recipes-tpm2/ibmswtpm2/ibmswtpm2_1661.bb index 7ea40a8c0..09b652deb 100644 --- a/meta-security/meta-tpm/recipes-tpm2/ibmswtpm2/ibmswtpm2_1661.bb +++ b/meta-security/meta-tpm/recipes-tpm2/ibmswtpm2/ibmswtpm2_1661.bb @@ -9,7 +9,7 @@ Advantages of this approach: \ * Application software errors are easily reversed by simply removing the TPM state and starting over. \ * Difficult crypto errors are quickly debugged by looking inside the TPM." HOMEPAGE = "http://ibmswtpm.sourceforge.net/ibmswtpm2.html" -LICENSE = "BSD" +LICENSE = "BSD-2-Clause" SECTION = "securty/tpm" LIC_FILES_CHKSUM = "file://../LICENSE;md5=1e023f61454ac828b4aa1bc4293f7d5f" diff --git a/meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss/ibmtpm2tss_1.6.0.bb b/meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss/ibmtpm2tss_1.6.0.bb index ae8974b6c..df6677963 100644 --- a/meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss/ibmtpm2tss_1.6.0.bb +++ b/meta-security/meta-tpm/recipes-tpm2/ibmtpm2tss/ibmtpm2tss_1.6.0.bb @@ -9,7 +9,7 @@ It also comes with a web based TPM interface, suitable for a demo to an \ audience that is unfamiliar with TCG technology. It is also useful for \ basic TPM management." HOMEPAGE = "http://ibmswtpm.sourceforge.net/ibmtss2.html" -LICENSE = "BSD" +LICENSE = "BSD-2-Clause" SECTION = "securty/tpm" LIC_FILES_CHKSUM = "file://LICENSE;md5=1e023f61454ac828b4aa1bc4293f7d5f" diff --git a/meta-security/recipes-core/initrdscripts/initramfs-framework-dm/dmverity b/meta-security/recipes-core/initrdscripts/initramfs-framework-dm/dmverity index 888052ccd..c815940fb 100644 --- a/meta-security/recipes-core/initrdscripts/initramfs-framework-dm/dmverity +++ b/meta-security/recipes-core/initrdscripts/initramfs-framework-dm/dmverity @@ -6,6 +6,7 @@ dmverity_enabled() { dmverity_run() { DATA_SIZE="__not_set__" + DATA_BLOCK_SIZE="__not_set__" ROOT_HASH="__not_set__" . /usr/share/misc/dm-verity.env @@ -49,7 +50,7 @@ dmverity_run() { done veritysetup \ - --data-block-size=1024 \ + --data-block-size=${DATA_BLOCK_SIZE} \ --hash-offset=${DATA_SIZE} \ create rootfs \ ${RDEV} \ diff --git a/meta-security/recipes-scanners/checksec/checksec_2.4.0.bb b/meta-security/recipes-scanners/checksec/checksec_2.4.0.bb index 000e3bb73..12c9bce30 100644 --- a/meta-security/recipes-scanners/checksec/checksec_2.4.0.bb +++ b/meta-security/recipes-scanners/checksec/checksec_2.4.0.bb @@ -1,7 +1,7 @@ SUMMARY = "Linux system security checks" DESCRIPTION = "The checksec script is designed to test what standard Linux OS and PaX security features are being used." SECTION = "security" -LICENSE = "BSD" +LICENSE = "BSD-3-Clause" HOMEPAGE="https://github.com/slimm609/checksec.sh" LIC_FILES_CHKSUM = "file://LICENSE.txt;md5=8d90285f711cf1f378e2c024457066d8" diff --git a/meta-security/recipes-scanners/clamav/clamav_0.104.0.bb b/meta-security/recipes-scanners/clamav/clamav_0.104.0.bb index 0d3a678e2..25123dce0 100644 --- a/meta-security/recipes-scanners/clamav/clamav_0.104.0.bb +++ b/meta-security/recipes-scanners/clamav/clamav_0.104.0.bb @@ -54,7 +54,7 @@ export OECMAKE_C_FLAGS += " -I${STAGING_INCDIR} -L ${RECIPE_SYSROOT}${nonarch_li do_install:append () { install -d ${D}/${sysconfdir} - install -d ${D}/${localstatedir}/lib/clamav + install -d -o ${CLAMAV_UID} -g ${CLAMAV_GID} ${D}/${localstatedir}/lib/clamav install -d ${D}${sysconfdir}/clamav ${D}${sysconfdir}/default/volatiles install -m 644 ${WORKDIR}/clamd.conf ${D}/${prefix}/${sysconfdir} @@ -83,7 +83,6 @@ pkg_postinst:${PN} () { elif [ -e ${sysconfdir}/init.d/populate-volatile.sh ]; then ${sysconfdir}/init.d/populate-volatile.sh update fi - chown -R ${CLAMAV_UID}:${CLAMAV_GID} ${localstatedir}/lib/clamav fi } @@ -149,5 +148,7 @@ SYSTEMD_PACKAGES = "${PN}-daemon ${PN}-freshclam" SYSTEMD_SERVICE:${PN}-daemon = "clamav-daemon.service" SYSTEMD_SERVICE:${PN}-freshclam = "clamav-freshclam.service" -RDEPENDS:${PN} = "openssl ncurses-libncurses libxml2 libbz2 ncurses-libtinfo curl libpcre2 clamav-freshclam clamav-libclamav" -RDEPENDS:${PN}-daemon = "clamav" +RDEPENDS:${PN} = "openssl ncurses-libncurses libxml2 libbz2 ncurses-libtinfo curl libpcre2 clamav-libclamav" +RRECOMMENDS:${PN} = "clamav-freshclam" +RDEPENDS:${PN}-freshclam = "clamav" +RDEPENDS:${PN}-daemon = "clamav clamav-freshclam" diff --git a/meta-security/recipes-scanners/rootkits/chkrootkit_0.53.bb b/meta-security/recipes-scanners/rootkits/chkrootkit_0.55.bb index 4536be393..20015a1cc 100644 --- a/meta-security/recipes-scanners/rootkits/chkrootkit_0.53.bb +++ b/meta-security/recipes-scanners/rootkits/chkrootkit_0.55.bb @@ -6,8 +6,7 @@ LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://COPYRIGHT;md5=fdbe53788f7081c63387d8087273f5ff" SRC_URI = "ftp://ftp.pangeia.com.br/pub/seg/pac/${BPN}.tar.gz" -SRC_URI[sha256sum] = "7262dae33b338976828b5d156b70d159e0043c0db43ada8dee66c97387cf45b5" - +SRC_URI[sha256sum] = "a81c0286ec449313f953701202a00e81b204fc2cf43e278585a11c12a5e0258b" inherit autotools-brokensep diff --git a/meta-security/recipes-security/cryfs/cryfs_0.10.3.bb b/meta-security/recipes-security/cryfs/cryfs_0.10.3.bb deleted file mode 100644 index 74f32a495..000000000 --- a/meta-security/recipes-security/cryfs/cryfs_0.10.3.bb +++ /dev/null @@ -1,10 +0,0 @@ -SUMMARY = "CryFS encrypts your files, so you can safely store them anywhere." -HOMEDIR = "https://www.cryfs.org" - -LICENSE = "LGPL-3.0" -FILE_CHK_SUM = "file://;md5=12345" - -SRC_URI = "https://github.com/${BPN}/${BPN}.git" -SRCREV = "0f83a1ab7e5ca9f37f97bc57b20d3fab0f351d11" - -inherit cmake diff --git a/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb b/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb new file mode 100644 index 000000000..a70d310a5 --- /dev/null +++ b/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb @@ -0,0 +1,49 @@ +SUMMARY = "fscrypt is a high-level tool for the management of Linux filesystem encryption" +DESCIPTION = "fscrypt manages metadata, key generation, key wrapping, PAM integration, \ +and provides a uniform interface for creating and modifying encrypted directories. For \ +a small, low-level tool that directly sets policies, see fscryptctl \ +(https://github.com/google/fscryptcl)." +HOMEPAGE = "https://github.com/google/fscrypt" +SECTION = "base" +LICENSE = "Apache-2.0" +LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=3b83ef96387f14655fc854ddc3c6bd57" + +BBCLASSEXTEND = "native nativesdk" + +# fscrypt depends on go and libpam +DEPENDS += "go-dep-native libpam" + +SRCREV = "92b1e9a8670ccd3916a7d24a06cab1e4c9815bc4" +SRC_URI = "git://github.com/google/fscrypt.git" +GO_IMPORT = "import" + +S = "${WORKDIR}/git" + +inherit go +inherit goarch + +do_compile() { + export GOARCH=${TARGET_GOARCH} + export GOROOT="${STAGING_LIBDIR_NATIVE}/${TARGET_SYS}/go" + export GOPATH="${WORKDIR}/git" + + # Pass the needed cflags/ldflags so that cgo + # can find the needed headers files and libraries + export CGO_ENABLED="1" + export CGO_CFLAGS="${CFLAGS} --sysroot=${STAGING_DIR_TARGET}" + export CGO_LDFLAGS="${LDFLAGS} --sysroot=${STAGING_DIR_TARGET}" + + cd ${S}/src/${GO_IMPORT} + oe_runmake + + # Golang forces permissions to 0500 on directories and 0400 on files in + # the module cache which prevents us from easily cleaning up the build + # directory. Let's just fix the permissions here so we don't have to + # hack the clean tasks. + chmod -R u+w ${S}/pkg/mod +} + +do_install() { + install -d ${D}/${bindir} + install ${S}/src/${GO_IMPORT}/bin/fscrypt ${D}/${bindir}/fscrypt +} diff --git a/meta-security/recipes-security/isic/isic_0.07.bb b/meta-security/recipes-security/isic/isic_0.07.bb index fb6e9046d..28153e3b4 100644 --- a/meta-security/recipes-security/isic/isic_0.07.bb +++ b/meta-security/recipes-security/isic/isic_0.07.bb @@ -2,7 +2,7 @@ SUMMARY = "ISIC -- IP Stack Integrity Checker" DESCRIPTION = "ISIC is a suite of utilities to exercise the stability of an IP Stack and its component stacks (TCP, UDP, ICMP et. al.)" HOMEPAGE = "http://isic.sourceforge.net/" SECTION = "security" -LICENSE = "BSD" +LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=d41d8cd98f00b204e9800998ecf8427e" DEPENDS = "libnet" diff --git a/meta-security/recipes-security/opendnssec/opendnssec_2.1.9.bb b/meta-security/recipes-security/opendnssec/opendnssec_2.1.9.bb index 8e368121a..6c1bd46b7 100644 --- a/meta-security/recipes-security/opendnssec/opendnssec_2.1.9.bb +++ b/meta-security/recipes-security/opendnssec/opendnssec_2.1.9.bb @@ -1,6 +1,6 @@ SUMMARY = "OpenDNSSEC is a policy-based zone signer that automates the process of keeping track of DNSSEC keys and the signing of zones" -LICENSE = "BSD" +LICENSE = "BSD-2-Clause" LIC_FILES_CHKSUM = "file://LICENSE;md5=b041dbe2da80d4efd951393fbba90937" DEPENDS = "libxml2 openssl ldns libmicrohttpd jansson libyaml " diff --git a/meta-security/recipes-security/sssd/files/CVE-2021-3621.patch b/meta-security/recipes-security/sssd/files/CVE-2021-3621.patch new file mode 100644 index 000000000..7a59df9c6 --- /dev/null +++ b/meta-security/recipes-security/sssd/files/CVE-2021-3621.patch @@ -0,0 +1,288 @@ +Backport patch to fix CVE-2021-3621. + +Upstream-Status: Backport [https://github.com/SSSD/sssd/commit/7ab83f9] +CVE: CVE-2021-3621 + +Signed-off-by: Kai Kang <kai.kang@windriver.com> + +From 7ab83f97e1cbefb78ece17232185bdd2985f0bbe Mon Sep 17 00:00:00 2001 +From: Alexey Tikhonov <atikhono@redhat.com> +Date: Fri, 18 Jun 2021 13:17:19 +0200 +Subject: [PATCH] TOOLS: replace system() with execvp() to avoid execution of + user supplied command +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +:relnote: A flaw was found in SSSD, where the sssctl command was +vulnerable to shell command injection via the logs-fetch and +cache-expire subcommands. This flaw allows an attacker to trick +the root user into running a specially crafted sssctl command, +such as via sudo, to gain root access. The highest threat from this +vulnerability is to confidentiality, integrity, as well as system +availability. +This patch fixes a flaw by replacing system() with execvp(). + +:fixes: CVE-2021-3621 + +Reviewed-by: Pavel Březina <pbrezina@redhat.com> +--- + src/tools/sssctl/sssctl.c | 39 ++++++++++++++++------- + src/tools/sssctl/sssctl.h | 2 +- + src/tools/sssctl/sssctl_data.c | 57 +++++++++++----------------------- + src/tools/sssctl/sssctl_logs.c | 32 +++++++++++++++---- + 4 files changed, 73 insertions(+), 57 deletions(-) + +diff --git a/src/tools/sssctl/sssctl.c b/src/tools/sssctl/sssctl.c +index 2997dbf968..8adaf30910 100644 +--- a/src/tools/sssctl/sssctl.c ++++ b/src/tools/sssctl/sssctl.c +@@ -97,22 +97,36 @@ sssctl_prompt(const char *message, + return SSSCTL_PROMPT_ERROR; + } + +-errno_t sssctl_run_command(const char *command) ++errno_t sssctl_run_command(const char *const argv[]) + { + int ret; ++ int wstatus; + +- DEBUG(SSSDBG_TRACE_FUNC, "Running %s\n", command); ++ DEBUG(SSSDBG_TRACE_FUNC, "Running '%s'\n", argv[0]); + +- ret = system(command); ++ ret = fork(); + if (ret == -1) { +- DEBUG(SSSDBG_CRIT_FAILURE, "Unable to execute %s\n", command); + ERROR("Error while executing external command\n"); + return EFAULT; +- } else if (WEXITSTATUS(ret) != 0) { +- DEBUG(SSSDBG_CRIT_FAILURE, "Command %s failed with [%d]\n", +- command, WEXITSTATUS(ret)); ++ } ++ ++ if (ret == 0) { ++ /* cast is safe - see ++ https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html ++ "The statement about argv[] and envp[] being constants ... " ++ */ ++ execvp(argv[0], discard_const_p(char * const, argv)); + ERROR("Error while executing external command\n"); +- return EIO; ++ _exit(1); ++ } else { ++ if (waitpid(ret, &wstatus, 0) == -1) { ++ ERROR("Error while executing external command '%s'\n", argv[0]); ++ return EFAULT; ++ } else if (WEXITSTATUS(wstatus) != 0) { ++ ERROR("Command '%s' failed with [%d]\n", ++ argv[0], WEXITSTATUS(wstatus)); ++ return EIO; ++ } + } + + return EOK; +@@ -132,11 +146,14 @@ static errno_t sssctl_manage_service(enum sssctl_svc_action action) + #elif defined(HAVE_SERVICE) + switch (action) { + case SSSCTL_SVC_START: +- return sssctl_run_command(SERVICE_PATH" sssd start"); ++ return sssctl_run_command( ++ (const char *[]){SERVICE_PATH, "sssd", "start", NULL}); + case SSSCTL_SVC_STOP: +- return sssctl_run_command(SERVICE_PATH" sssd stop"); ++ return sssctl_run_command( ++ (const char *[]){SERVICE_PATH, "sssd", "stop", NULL}); + case SSSCTL_SVC_RESTART: +- return sssctl_run_command(SERVICE_PATH" sssd restart"); ++ return sssctl_run_command( ++ (const char *[]){SERVICE_PATH, "sssd", "restart", NULL}); + } + #endif + +diff --git a/src/tools/sssctl/sssctl.h b/src/tools/sssctl/sssctl.h +index 0115b2457c..599ef65196 100644 +--- a/src/tools/sssctl/sssctl.h ++++ b/src/tools/sssctl/sssctl.h +@@ -47,7 +47,7 @@ enum sssctl_prompt_result + sssctl_prompt(const char *message, + enum sssctl_prompt_result defval); + +-errno_t sssctl_run_command(const char *command); ++errno_t sssctl_run_command(const char *const argv[]); /* argv[0] - command */ + bool sssctl_start_sssd(bool force); + bool sssctl_stop_sssd(bool force); + bool sssctl_restart_sssd(bool force); +diff --git a/src/tools/sssctl/sssctl_data.c b/src/tools/sssctl/sssctl_data.c +index 8d79b977fd..bf22913416 100644 +--- a/src/tools/sssctl/sssctl_data.c ++++ b/src/tools/sssctl/sssctl_data.c +@@ -105,15 +105,15 @@ static errno_t sssctl_backup(bool force) + } + } + +- ret = sssctl_run_command("sss_override user-export " +- SSS_BACKUP_USER_OVERRIDES); ++ ret = sssctl_run_command((const char *[]){"sss_override", "user-export", ++ SSS_BACKUP_USER_OVERRIDES, NULL}); + if (ret != EOK) { + ERROR("Unable to export user overrides\n"); + return ret; + } + +- ret = sssctl_run_command("sss_override group-export " +- SSS_BACKUP_GROUP_OVERRIDES); ++ ret = sssctl_run_command((const char *[]){"sss_override", "group-export", ++ SSS_BACKUP_GROUP_OVERRIDES, NULL}); + if (ret != EOK) { + ERROR("Unable to export group overrides\n"); + return ret; +@@ -158,8 +158,8 @@ static errno_t sssctl_restore(bool force_start, bool force_restart) + } + + if (sssctl_backup_file_exists(SSS_BACKUP_USER_OVERRIDES)) { +- ret = sssctl_run_command("sss_override user-import " +- SSS_BACKUP_USER_OVERRIDES); ++ ret = sssctl_run_command((const char *[]){"sss_override", "user-import", ++ SSS_BACKUP_USER_OVERRIDES, NULL}); + if (ret != EOK) { + ERROR("Unable to import user overrides\n"); + return ret; +@@ -167,8 +167,8 @@ static errno_t sssctl_restore(bool force_start, bool force_restart) + } + + if (sssctl_backup_file_exists(SSS_BACKUP_USER_OVERRIDES)) { +- ret = sssctl_run_command("sss_override group-import " +- SSS_BACKUP_GROUP_OVERRIDES); ++ ret = sssctl_run_command((const char *[]){"sss_override", "group-import", ++ SSS_BACKUP_GROUP_OVERRIDES, NULL}); + if (ret != EOK) { + ERROR("Unable to import group overrides\n"); + return ret; +@@ -296,40 +296,19 @@ errno_t sssctl_cache_expire(struct sss_cmdline *cmdline, + void *pvt) + { + errno_t ret; +- char *cmd_args = NULL; +- const char *cachecmd = SSS_CACHE; +- char *cmd = NULL; +- int i; +- +- if (cmdline->argc == 0) { +- ret = sssctl_run_command(cachecmd); +- goto done; +- } + +- cmd_args = talloc_strdup(tool_ctx, ""); +- if (cmd_args == NULL) { +- ret = ENOMEM; +- goto done; ++ const char **args = talloc_array_size(tool_ctx, ++ sizeof(char *), ++ cmdline->argc + 2); ++ if (!args) { ++ return ENOMEM; + } ++ memcpy(&args[1], cmdline->argv, sizeof(char *) * cmdline->argc); ++ args[0] = SSS_CACHE; ++ args[cmdline->argc + 1] = NULL; + +- for (i = 0; i < cmdline->argc; i++) { +- cmd_args = talloc_strdup_append(cmd_args, cmdline->argv[i]); +- if (i != cmdline->argc - 1) { +- cmd_args = talloc_strdup_append(cmd_args, " "); +- } +- } +- +- cmd = talloc_asprintf(tool_ctx, "%s %s", cachecmd, cmd_args); +- if (cmd == NULL) { +- ret = ENOMEM; +- goto done; +- } +- +- ret = sssctl_run_command(cmd); +- +-done: +- talloc_free(cmd_args); +- talloc_free(cmd); ++ ret = sssctl_run_command(args); + ++ talloc_free(args); + return ret; + } +diff --git a/src/tools/sssctl/sssctl_logs.c b/src/tools/sssctl/sssctl_logs.c +index 9ff2be05b6..ebb2c4571c 100644 +--- a/src/tools/sssctl/sssctl_logs.c ++++ b/src/tools/sssctl/sssctl_logs.c +@@ -31,6 +31,7 @@ + #include <ldb.h> + #include <popt.h> + #include <stdio.h> ++#include <glob.h> + + #include "util/util.h" + #include "tools/common/sss_process.h" +@@ -230,6 +231,7 @@ errno_t sssctl_logs_remove(struct sss_cmdline *cmdline, + { + struct sssctl_logs_opts opts = {0}; + errno_t ret; ++ glob_t globbuf; + + /* Parse command line. */ + struct poptOption options[] = { +@@ -253,8 +255,20 @@ errno_t sssctl_logs_remove(struct sss_cmdline *cmdline, + + sss_signal(SIGHUP); + } else { ++ globbuf.gl_offs = 4; ++ ret = glob(LOG_PATH"/*.log", GLOB_ERR|GLOB_DOOFFS, NULL, &globbuf); ++ if (ret != 0) { ++ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand log files list\n"); ++ return ret; ++ } ++ globbuf.gl_pathv[0] = discard_const_p(char, "truncate"); ++ globbuf.gl_pathv[1] = discard_const_p(char, "--no-create"); ++ globbuf.gl_pathv[2] = discard_const_p(char, "--size"); ++ globbuf.gl_pathv[3] = discard_const_p(char, "0"); ++ + PRINT("Truncating log files...\n"); +- ret = sssctl_run_command("truncate --no-create --size 0 " LOG_FILES); ++ ret = sssctl_run_command((const char * const*)globbuf.gl_pathv); ++ globfree(&globbuf); + if (ret != EOK) { + ERROR("Unable to truncate log files\n"); + return ret; +@@ -269,8 +283,8 @@ errno_t sssctl_logs_fetch(struct sss_cmdline *cmdline, + void *pvt) + { + const char *file; +- const char *cmd; + errno_t ret; ++ glob_t globbuf; + + /* Parse command line. */ + ret = sss_tool_popt_ex(cmdline, NULL, SSS_TOOL_OPT_OPTIONAL, NULL, NULL, +@@ -280,13 +294,19 @@ errno_t sssctl_logs_fetch(struct sss_cmdline *cmdline, + return ret; + } + +- cmd = talloc_asprintf(tool_ctx, "tar -czf %s %s", file, LOG_FILES); +- if (cmd == NULL) { +- ERROR("Out of memory!"); ++ globbuf.gl_offs = 3; ++ ret = glob(LOG_PATH"/*.log", GLOB_ERR|GLOB_DOOFFS, NULL, &globbuf); ++ if (ret != 0) { ++ DEBUG(SSSDBG_CRIT_FAILURE, "Unable to expand log files list\n"); ++ return ret; + } ++ globbuf.gl_pathv[0] = discard_const_p(char, "tar"); ++ globbuf.gl_pathv[1] = discard_const_p(char, "-czf"); ++ globbuf.gl_pathv[2] = discard_const_p(char, file); + + PRINT("Archiving log files into %s...\n", file); +- ret = sssctl_run_command(cmd); ++ ret = sssctl_run_command((const char * const*)globbuf.gl_pathv); ++ globfree(&globbuf); + if (ret != EOK) { + ERROR("Unable to archive log files\n"); + return ret; diff --git a/meta-security/recipes-security/sssd/sssd_2.5.1.bb b/meta-security/recipes-security/sssd/sssd_2.5.2.bb index 1c77480eb..76d6e03e9 100644 --- a/meta-security/recipes-security/sssd/sssd_2.5.1.bb +++ b/meta-security/recipes-security/sssd/sssd_2.5.2.bb @@ -23,9 +23,10 @@ SRC_URI = "https://github.com/SSSD/sssd/releases/download/${PV}/sssd-${PV}.tar.g file://drop_ntpdate_chk.patch \ file://fix-ldblibdir.patch \ file://musl_fixup.patch \ + file://CVE-2021-3621.patch \ " -SRC_URI[sha256sum] = "ce2f5d84a3f1750093318afd27f4fd75b1e3e75f7d80fc42d21a40cc54b58ea4" +SRC_URI[sha256sum] = "5e21b3c7b4a2f1063d0fbdd3216d29886b6eaba153b44fb5961698367f399a0f" inherit autotools pkgconfig gettext python3-dir features_check systemd |