From 15ae2509e522678e761046cdb8693291c09cf78c Mon Sep 17 00:00:00 2001 From: Brad Bishop Date: Tue, 18 Jun 2019 21:44:24 -0400 Subject: subtree updates MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit meta-openembedded: f3018013ff..3b245e4fe8: Adrian Bunk (8): Remove start-stop-daemon dvb-apps: Remove workaround patch for ancient target compilers Remove ipsec-tools and umip gpsd: Switch PACKAGECONFIG[qt] from Qt4 to Qt5 samba: Upgrade 4.8.11 -> 4.8.12 recipes-devtools: Move back from meta-networking to meta-perl wireless-regdb: Upgrade 2019.03.01 -> 2019.06.03 mcelog: Remove manual RDEPENDS from PN-ptest to PN package Alejandro del Castillo (1): apache2: add all extra/*.conf to conffiles Alistair Francis (1): python-obd: Uprade from 0.7.0 to 0.7.1 Andreas Müller (1): python-six: put python2/3 variant together Andrei Gherzan (2): modemmanager: Update to 1.10.0 networkmanager: Update to 1.18.0 Ankit Navik (1): safec: Initial recipe for safe C library Carlos Rafael Giani (1): openh264: Fix armv7ve build Changqing Li (11): syslog-ng: add rconflict for package syslog-ng-libs netkit-telnet: add rconflicts samba/libldb: add rconflicts php-fpm-apache: fix module path phoronix-test-suite: upgrade from 8.6.0 -> 8.8.1 python-pygobject: upgrade 3.28.3 -> 3.32.1 rrdtool: upgrade 1.7.1 -> 1.7.2 php: upgrade 7.3.4 -> 7.3.6 xf86-video-ati: upgrade 18.0.1 -> 19.0.1 pavucontrol: upgrade 3.0 -> 4.0 multipath-tools: upgrade 0.8.0 -> 0.8.1 Herman van Hazendonk (1): Geoclue: Update to 2.5.3 Hongxu Jia (4): rrdtool: improve reproducibility crash: do not use unstable github archive tarballs postgresql: improve reproducibility net-snmp: split net-snmp-config to package net-snmp-dev Hongzhi.Song (1): spice: fix compile errors on 32bit system Horvath, Chris (1): lcov: Upgrade 1.11 -> 1.14 James Feist (1): libgpiod: Enable cxx bindings by default Kai Kang (16): xfce4-session: 4.13.1 -> 4.13.2 xfce4-screensaver: add recipe packagegroup-xfce-extended: add xfce4-screensaver lxdm: provides fake gdmflexiserver for xfce desktop environment thunar: 1.8.4 -> 1.8.6 xfdesktop: 4.13.3 -> 4.13.4 xfce4-panel: 4.13.4 -> 4.13.5 thunar-volman: 0.9.1 -> 0.9.2 xfce4-appfinder: 4.13.2 -> 4.13.3 libxfce4util: 4.13.2 -> 4.13.3 xfwm4: 4.13.1 -> 4.13.2 xfconf: 4.13.6 -> 4.13.7 libxfce4ui: 4.13.4 -> 4.13.5 xfce4-power-manager: 1.6.1 -> 1.6.2 xfce4-settings: set default theme Adwaita lxdm: provides fake gdmflexiserver for xfce desktop environment Khem Raj (8): libnfc: Fix build with musl openocd: Fix build on x86_64 spice,spice-protocol: Uprev to 0.14.0 udisks: Install bash_completion script in OE familiar dir udisks: Remove bash dependency python-jsmin,python-pytoml,python-which: Add recipes mozjs: Upgrade to version 60.x polkit: Upgrade to 0.116 Liwei Song (1): turbostat: copy bits.h from kernel to turbostat Marek Belisko (1): libsrtp: Fix compilation and add pkgconfig Martin Jansa (17): igmpproxy: remove 0001-src-igmpproxy.h-Include-sys-types.h-for-u_short-u_in.patch and _GNU_SOURCE ne10, libopus: add armv7ve override as well pidgin: upgrade to 2.13.0 funyahoo-plusplus, icyque, pidgin-sipe, purple-skypeweb: add couple plugins for pidgin hunspell: use git fetcher instead of github archive hunspell-dictionaries: import from meta-luneos to make hunspell in meta-oe a bit more useful ttf-mplus, ttf-vlgothic: add ttf-mplus license android-tools-conf: import one more improvement for android-gadget-setup from meta-luneos uriparser: upgrade to 0.9.3 libmikmod: fix SRC_URI leptonica: fix SRC_URI libmikmod: upgrade to 3.3.11.1 open-vm-tools: refresh the patches so that they can be easily applied with devtool or git am open-vm-tools: import gcc9 fixes from fedora spice: append to CFLAGS instead of += cpprest: temporary ignore deprecated-copy and redundant-move errors detected by gcc9 oprofile: drop virtual/kernel dependency and switch back to TUNE_PKGARCH Mingli Yu (4): mariadb: Upgrade to 10.3.15 kea: Upgrade to 1.5.0 hwloc: Upgrade to 1.11.12 kea: replace -Og with -O Naveen Saini (1): pm-graph: add recipe Oleksandr Kravchuk (12): opensaf: update to 5.19.03 python-ldap: update to 3.2.0 rp-pppoe: update to 3.13 atftp: update to 0.7.2 ipcalc: update to 2.2.3 mtr: update to 0.92 nbd: update to 3.19 mdns: update to 878.200.35 lldpd: update to 1.0.3 libp11: update to 0.4.10 nano: update to 4.2 libspatialite: update to 4.3.0a Ovidiu Panait (1): xfsprogs: Fix host contamination Paolo Valente (1): s-suite: push SRCREV to version 3.4 Pascal Bach (1): rocksdb: 5.18.3 -> 6.0.2 Qi.Chen@windriver.com (2): polkit: fix CVE-2019-6133 .gitignore: add *.pyc and *.pyo Randy MacLeod (1): imagemagick: update from 7.0.8-43 to 7.0.8-47 Robert Joslyn (4): cryptsetup: Add PACKAGECONFIG options lmsensors: Update to 3.5.0 xfce4-session: Add xrdb RDEPENDS xfce4-session: Reformat DEPENDS and RDEPENDS Slater, Joseph (1): php-7: mark two tests as expected to fail Stefan Agner (1): haveged: fix CPU cache size detection Tim Orling (13): libterm-readkey-perl: upgrade 2.37 -> 2.38; fix upstream check; enable ptest libtest-deep-perl: add recipe for v1.128 libcgi-perl: upgrade 4.38 -> 4.43; enable ptest libcrypt-openssl-guess-perl: rename from libcrypt-openssl-guess; enable ptest libcrypt-openssl-rsa-perl: upgrade 0.30 -> 0.31; enable ptest libcrypt-openssl-random-perl: upgrade 0.11 -> 0.15; enable ptest libextutils-installpaths-perl: upgrade 0.011 -> 0.012; enable ptest libexutils-config-perl: enable ptest libhtml-tagset-perl: add recipe for v3.20 libhtml-parser-perl: enable ptest libstrictures-perl: upgrade 2.000003 -> 2.000006; enable ptest libxml-libxml-perl: enable ptest libcapture-tiny-perl: upgrade 0.46 -> 0.48; enable ptest William A. Kennington III via Openembedded-devel (1): cli11: 1.6.2 -> 1.7.1 Yi Zhao (8): python-ldap: add python-pyasn1 and python-pyasn1-modules as runtime dependencies fuse: upgrade 2.9.8 -> 2.9.9 yaffs2-utils: update to latest master xfsprogs: upgrade 4.18.0 -> 5.0.0 fcgi: upgrade 2.4.1+git -> 2.4.2 xdebug: upgrade 2.7.0RC2 -> 2.7.2 phpmyadmin: upgrade 4.8.5 -> 4.9.0.1 openipmi: upgrade 2.0.25 -> 2.0.27 Zang Ruochen (13): python-pywbem: solved the conflict with python3-pywbem python3-pywbem:solved the conflict with python-pywbem python-pbr: upgrade 5.2.0 -> 5.2.1 python-mako: upgrade 1.0.10 -> 1.0.12 python-babel: upgrade 2.6.0 -> 2.7.0 python-cachetools: upgrade 3.1.0 -> 3.1.1 python-cryptography: upgrade 2.6.1 -> 2.7 python-cryptography-vectors: upgrade 2.6.1 -> 2.7 python-cython: upgrade 0.29.7 -> 0.29.10 python-lxml: upgrade 4.3.3 -> 4.3.4 python-psutil: upgrade 5.6.2 -> 5.6.3 python-requests: upgrade 2.21.0 -> 2.22.0 python-urllib3: upgrade 1.25.2 -> 1.25.3 nick83ola (5): nginx: update to version 1.17.0 nginx: update stable version to 1.16.0 nginx: add PACKAGECONFIG[http-auth-request] nginx: fix kill path in nginx systemd unit file uthash: do not use unstable github archive tarballs thstead (1): Upgraded python-pysnmp from version 4.3.5. to 4.4.9. Łukasz Łaguna (1): gsl: update to version 2.5 meta-security: 9f5cc2a7eb..c28b72e91d: Armin Kuster (17): checksec: update to 1.11.1 keyutils: fix library install path checksec: add runtime test meta-integrity: port over from meta-intel-iot-security layer.conf: add LAYERSERIES_COMPAT README: update ima-evm-utils: cleanup and update to tip ima.cfg: update to 5.0 kernel linux: update bbappend base-files: add appending to automount securityfs ima-policy-hashed: add new recipe ima_policy_simple: add another sample policy policy: add ima appraise all policy data: remove policies initramfs: clean up to pull in packages. runtime qa: moderize ima test image: add image for testing Changqing Li (1): samhain: add rconflict for client and server mode Zang Ruochen (4): bastille: solved the conflict with perl-module-text-wrap and base-files python-scapy: Remove redundant sed operations python-scapy: solved the conflict with python3-scapy python3-scapy: solved the conflict with python-scapy leimaohui (1): python3-fail2ban: Fix build error of xrange. poky: 797916f93a..111b7173fe: Adrian Bunk (25): nss-myhostname: Stop trying to build for musl systemd: Some upstreamable musl patches have been upstreamed libnss-mdns: Stop trying to build for musl icu: Remove workaround for musl issue fixed upstream 2 years ago socat: Remove workaround for musl issue now fixed upstream ofono: Use external ell instead of an internal copy ofono: Fix another race condition during the build squashfs-tools: Mark as incompatible with musl apt: Remove workaround patches for no longer supported host distributions m4/tar: Remove remove-gets.patch pinentry: Switch pinentry-qt from Qt4 to Qt5 librsvg: Replace workaround for old host systems with upstream fix vim: Move PACKAGECONFIG[gtkgui] from GTK 2 to GTK 3 Remove Go 1.11 go: Remove INSANE_SKIP_* textrel that are now handled in go.bbclass dpkg: Remove workaround patches for no longer supported host distributions lrzsz: Add implicit declaration fixes from Debian tcp-wrappers: Add compile warning fixes from Debian libpam: Upgrade 1.3.0 -> 1.3.1 vte: Fix the license information gcc: Remove 0006-gcc-disable-MASK_RELAX_PIC_CALLS-bit.patch openssl: Upgrade 1.1.1b -> 1.1.1c Remove manual RDEPENDS from PN-ptest to PN package ref-manual: Remove irda feature lttng-modules: Upgrade 2.10.9 -> 2.10.10 Adrian Freihofer (3): qemurunner: fix undefined variable testimage: consider QB_DEFAULT_FSTYPE runqemu: QB_FSINFO to support fstype wic images Alejandro Enedino Hernandez Samaniego (1): python-numpy: Avoid installing copy of f2py script Alejandro Hernandez Samaniego (2): newlib: Upgrade to 3.1.0 newlib: export CC_FOR_TARGET as CC Alejandro del Castillo (1): opkg-utils: upgrade to version 0.4.1 Alex Kiernan (2): kernel-fitimage: uboot-sign: Check UBOOT_DTB_BINARY before adding deps systemd: Backport OpenSSL BUF_MEM fix Alexander Kanavin (53): vim: split the common part into vim.inc libpcre2: upgrade 10.32 -> 10.33 librepo: upgrade 1.9.6 -> 1.10.2 libmodulemd: upgrade 2.2.3 -> 2.4.0 libmodulemd: fix erroneous linking against v2 library when v1 was requested createrepo-c: upgrade 0.12.2 -> 0.14.0 libdazzle: upgrade 3.32.1 -> 3.32.2 adwaita-icon-theme: upgrade 3.30.1 -> 3.32.0 bison: upgrade 3.1 -> 3.3.2 atk: upgrade 2.30.0 -> 2.32.0 python3-mako: upgrade 1.0.9 -> 1.0.10 nss: upgrade 3.43 -> 3.44 go: update 1.12.1->1.12.5 systemtap: upgrade 4.0 -> 4.1 gawk: upgrade 4.2.1 -> 5.0.0 alsa-plugins: upgrade 1.1.8 -> 1.1.9 alsa-utils: upgrade 1.1.8 -> 1.1.9 alsa-lib: upgrade 1.1.8 -> 1.1.9 lz4: upgrade 1.9.0 -> 1.9.1 libxcrypt: upgrade 4.4.4 -> 4.4.6 python3-pip: upgrade 19.0.3 -> 19.1.1 pkgconf: upgrade 1.6.0 -> 1.6.1 at-spi2-core: upgrade 2.30.0 -> 2.32.1 at-spi2-atk: upgrade 2.30.0 -> 2.32.0 glib-networking: upgrade 2.60.1 -> 2.60.2 libsoup-2.4: upgrade 2.66.1 -> 2.66.2 x264: upgrade to latest revision linux-firmware: upgrade to latest revision python3-pbr: upgrade 5.1.3 -> 5.2.0 bash-completion: upgrade 2.8 -> 2.9 gst-examples: upgrade to 1.16.0 acpica: upgrade 20190405 -> 20190509 freetype: upgrade 2.9.1 -> 2.10.0 usbutils: upgrade 010->012 webkitgtk: update to 2.24.2 epiphany: update to 3.32.2 btrfs-tools: update to 5.1 iproute2: upgrade 5.0.0 -> 5.1.0 chkconfig: do not use unstable github archive tarballs chkconfig: fix upstream version check perl: update to 5.30.0 piglit: upgrade to latest revision ccache: fix upstream version check Revert "ncurses: fix incorrect UPSTREAM_CHECK_GITTAGREGEX" sysstat: add UPSTREAM_VERSION_UNKNOWN python3-pygments: add a recipe gtk-doc: upgrade 1.29 -> 1.30 libpsl: fix the gtk-doc 1.30 build source-highlight: remove the recipe mesa-demos: update to 8.4.0 glib-2.0: udpate 2.58.3 -> 2.60.3 gdk-pixbuf: update 2.38.0 -> 2.38.1 gtk+3: update 3.24.5 -> 3.24.8 Alistair Francis (3): gdb: Upgrade from 8.2.1 to 8.3 gnu-config: Update to latest SHA qemu: Backport the arm segfault fix Andreas Müller (1): gsettings-desktop-schemas: upgrade 3.28.1 -> 3.32.0 Andrei Gherzan (1): ca-certificates: Fix openssl runtime dependencies Anuj Mittal (8): Revert "image_types: use pigz to create .gz files" Revert "pigz: pigz is not gzip" libva: upgrade 2.4.0 -> 2.4.1 ffmpeg: add PACKAGECONFIG for mfx libpam: fix upstream version check serf: cleanup recipe scons: inherit python3native python3-scons: fix regex replacing python by python3 Bonnans, Laurent (1): kernel-uboot: compress arm64 kernels Bruce Ashfield (11): linux-yocto/5.0: update to v5.0.13 linux-yocto/4.19: update to v4.19.40 linux-yocto/4.19: update to v4.19.44 kernel: package modules.builtin.modinfo linux-yocto-dev: bump to v5.2-rc linux-yocto/5.0: update to v5.0.17 linux-yocto-rt/5.0: update to -rt9 linux-yocto/5.0: update to v5.0.19 linux-yocto-rt/5.0: update to -rt11 linux-yocto/5.0: fix systemtap on arm linux-yocto: ptest: Add SCSI debug configuration for util-linux Carlos Rafael Giani (6): gstreamer1.0-plugins-base: upgrade to version 1.16.0 gstreamer1.0-plugins-good: upgrade to version 1.16.0 gstreamer1.0-plugins-bad: upgrade to version 1.16.0 gstreamer1.0-plugins-ugly: upgrade to version 1.16.0 gstreamer1.0-libav: upgrade to version 1.16.0 gstreamer1.0-vaapi: upgrade to version 1.16.0 Changqing Li (8): connman: add networkmanager as rconflict dropbear: add openssh/openssh-sshd as rconflict busybox-inittab/sysvinit-inittab: add rconflicts inetutils: fix wrong package name systemd: add rconflicts tiny-init: add rconflicts multilib: add override for image recipe qemu: fix qemu ptest cannot work Chee Yang Lee (3): wic: bootimg-efi: add label source parameter wic/engine: include .wks.in in wic search and list wic/plugins: kernel image refer to KERNEL_IMAGETYPE Chen Qi (5): libxfont2: set CVE_PRODUCT systemd: avoid musl specific patches affect glibc systems util-linux: upgrade to 2.33.2 oescripts.py: avoid error when cairo module is not available context.py: fix skipping function Chris Laplante (5): base.bbclass: Add OE_EXTRA_IMPORTS bitbake: knotty: allow progress rate for indeterminate bars bitbake: build: extract progress handler creation logic into its own method bitbake: build/progress: use context managers for progress handlers bitbake: build: implement custom progress handlers injected via OE_EXTRA_IMPORTS David Frey (1): bluez5: manage udev dependency with PACKAGECONFIG David Reyna (1): bitbake: toaster: Fix Thud Bitbake release metadata Diego Rondini (1): bluez5: fix obex packaging Douglas Royds via Openembedded-core (1): json-c: Backport --disable-werror patch to allow compilation under icecc Fabio Berton (3): mesa: Update 19.0.3 -> 19.0.5 mesa: Update 19.0.5 -> 19.0.6 mesa: Update 19.0.6 -> 19.1.0 Filip Jareš (1): recipes: Fix license "names"/versions. Haiqing Bai (1): kernel.bbclass: Make task clean depend on cleaning of make-mod-scripts He Zhe (1): lttng-modules: Add git based recipe Hongxu Jia (5): grub/grub-efi: fix unrecognized command line option '-pipe-Wno-error' in CFLAGS lib/oe/reciputils.py: support character `+' in git pv groff: improve reproducibility diffutils/run-ptest: support to run at arbitrary path openssh: fix potential signed overflow in pointer arithmatic Jaewon Lee (2): gstreamer1.0-python_1.16.0.bb: Override libpython dir devicetree.bbclass: Combine stderr into stdout to see actual dtc error Jean-Marie LEMETAYER (4): npm: get npm package name from npm pack npm: fix node and npm default directory conflict npm: remove some temporary build files bitbake: bitbake: fetch2/npm: fix npw view parsing Jiping Ma (1): dhcp:"dhclient -x eth0" action is not correct. Joe Slater (1): slang: modify an array test Jon Mason (2): resulttool: modify to be multi-machine resulttool: Remove prints if no tests occur Jonathan Rajotte (4): lttng-tools: prevent test timeout when lttng-modules is not present lttng-tools: add lttng-modules to ptest dependencies liburcu: update to 0.11.0 liburcu: update to 0.11.1 Joshua Watt (11): avahi: Add PACKAGECONFIG for libdns_sd perl: Preserve attributes when applying cross files btrfs-tools: Pass DEBUG_MAP_PREFIX flags to Python bitbake: bitbake: cooker: Rename __depends in all multiconfigs bitbake: bitbake: Show base multiconfig environment perl: Set build date to SOURCE_DATE_EPOCH glibc-locale: DEPEND on virtual/libc zip: Remove build date to improve reproducibility classes/package: Sort ELF file list bash: Replace uninative loader path in ptest oeqa: Add reproducible build selftest Kai Kang (3): systemd-conf: configure wired network with dhcp qemu/qemu-system-native: depend bison-native openssl: fix failure of ptest test_shlibload Kevin Hao (3): runqemu: Add the support to pass multi ports to tcpserial parameter oeqa/utils/qemurunner: Set both the threadport&serverport with tcpserial parameter tune-thunderx: Set the correct PACKAGE_EXTRA_ARCHS_tune-thunderx Khem Raj (6): mesa: Fix a case when gbm is enabled but DRIDRIVERS is not defined ofono: Add TEMP_FAILURE_RETRY optional definition Revert "musl: Add TEMP_FAILURE_RETRY from glibc" binutils: Workaround mips assembler crash on target musl: Upgrade to master tip gdb: Let gdbserver be empty for riscv64 Lei Maohui (1): meson.bbclass: Make meson support aarch64_be. Luca Boccassi (2): python*-setuptools: add separate packages for pkg_resources module mdadm: use ${systemd_unitdir} rather than /lib/systemd Maciej Pijanowski (1): recipetool: add python3 support Mariano López (3): util-linux: Add missing ptest dependencies util-linux: Stop udevd to run ptests linux-yocto: Add scsi_debug module when ptest is in DISTRO_FEATURES Mark Hatle (1): bitbake: svn.py: Stop SVN from directly pulling from an external layer w/o fetcher Martin Jansa (5): python: add a fix for CVE-2019-9948 and CVE-2019-9636 glib-networking: add PACKAGECONFIG for openssl bc: use u-a for bc as well opkg-utils: fix opkg-list-fields script pigz: install pigz, unpigz, pigzcat in native and nativesdk builds again Matthias Schiffer (1): bitbake: fetch2: runfetchcmd(): unset _PYTHON_SYSCONFIGDATA_NAME Matthias Schoepfer via Openembedded-core (1): python3: fix build on softfloat mips Michael Ho (1): base.bbclass: add named SRCREVs to the sstate hash Mike Crowe (1): cmake: Avoid passing empty prefix to os.path.relpath Mingli Yu (3): elfutils: fix ptest failures dbus: Upgrade to 1.12.16 dbus-test: Upgrade 1.12.16 Nicola Lunghi (3): connman: fix segfault with musl >v1.1.21 rng-tools: recipe cleanup rng-tools: harmonise systemd and sysvinit Oleksandr Kravchuk (6): ethtool: update to 5.1 file: update to 5.37 p11-kit: update to 0.23.16.1 popt: fix SRC_URI selftest/devtool: fix URI to MarkupSafe package bitbake: cooker: list all nonexistent bblayer directories Oliver Stäbler (1): packagegroup-core-full-cmdline: Make nfs-utils/rpcbind optional Peter Kjellerstedt (3): texinfo-dummy-native: A little clean up of template.py texinfo-dummy-native: Rewrite template.py to use argparse package.bbclass: Clean up writing of runtime pkgdata files Philippe Normand (9): gstreamer1.0: upgrade to version 1.16.0 gstreamer1.0-omx: upgrade to version 1.16.0 gstreamer1.0-rtsp-server: upgrade to version 1.16.0 gstreamer1.0-python: upgrade to version 1.16.0 gst-validate: upgrade to version 1.16.0 cmake: Use compiler launcher variable when ccache is enabled at-spi2: Make X11 support truly optional gnutls: Use ca-certificates as default trust store file gnutls: Use the sysconfdir variable for the ca-certificates path Quentin Schulz (2): meta: license: fix non-SPDX license being removed from INCOMPATIBLE_LICENSE selftests: add tests for INCOMPATIBLE_LICENSE Randy MacLeod (6): valgrind: Make ptest timestamps copasetic valgrind: add 'file' to ptest depends util-linux: add setpriv utility libcap-ng: split into libcap-ng/libcap-ng-python ptest-runner: enable child procs as session leader bash: use setpriv, sed.sed to run ptests Richard Purdie (46): perl-rdepends: Add missing module dependencies bash: Fix bash-ptest dependencies openssh: Add sudo dependency for ptest libpcre: Add make dependency for ptest m4: Add coreutils and diffutils dependency for ptest perl/modules: Add various missing ptest perl module dependencies layer.conf: Whitelist lttng-tools->lttng-modules dependency tcmode-default: Make gcc9 the default lttng-tools: Fix patch Upstream-Status mesa: Fix patch Upstream-Status uninative-tarball: Fix file generation after class changes populate_sdk_base: Use highest compression level for xz uninative-tarball: Use xz compression and SDK_ARCHIVE_CMD strace: Tweak ptest disk space management ptest-packagelists: Add mdadm util-linux: Fix ptest dependencies mdadm: Add missing ptest dependency yocto-uninative: Update to 2.5 release uninative: Switch from bz2 to xz bitbake: main: Fix error message typo qemuarm64: Add QB_CPU_KVM to allow kvm acceleration runqemu: Add support for kvm on aarch64 useradd: Fix build architecture corruption of sstate artefacts useradd: Ensure do_populate_sysroot has dependency on useradd variables beaglebone-yocto: Add missing wic image u-boot deploy dependency quilt: Add patch depends for quilt-ptest libtest-needs-perl: Fix ptest dependencies libtimedate-perl: Fix ptest dependencies perl: Add missing perl module dependency liburi-perl: Fix module ptest dependencies libconvert-aan1-perl: Fix module and ptest dependencies libxml-sax-perl: Fix module ptest dependencies libxml-perl: Fix module and ptest dependencies e2fsprogs: Fix missing ptest dependencies glib-2.0: ptest fixes openssh: Add missing ptest dependency on coreutils gpg_sign/selftest: Fix secmem parameter handling gawk: ptest fixes openssh: Document skipped test dependency multiconfig: Adapt to bitbake switch 'multiconfig' -> 'mc' bitbake: multiconfig: Switch from 'multiconfig' -> 'mc' bitbake: cooker: Add compability handling for multiconfig: prefix migration build-appliance-image: Update to master head revision bitbake: cooker: Ensure mcdeps are processed even if only one multiconfig perl: Fix setgroup call regression from 5.30 perl: Move perl-sanity -> perl Ross Burton (13): insane: add sanity checks to SRC_URI libidn2: upgrade to 2.2.0 local.conf.sample: change default MACHINE to qemux86-64 libical: tidy up Perl finding wic/filemap: handle FIGETBSZ failing libxslt: add comment saying when a workaround can be removed parted: swap patches for the commits that landed upstream parted: drop patch for linux <2.6.20 support python-nose: python3-nose should be default bluez: fix test case failures with GCC 9 efivar: add efibootmgr: add gstreamer1.0-libav: disable API documentation Sakib Sajal (4): bash: add iso8859-1 gconv RDEPENDS needed by bash-ptest. bash: add big5hkscs gconv RDEPENDS needed by bash-ptest. bash: run bash ptest as non-root user ptest-runner: update SRCREV to latest HEAD on ptest-runner2 repo Scott Rifenbark (17): sdk-manual: Added link to BB manual fetcher section. ref-manual: Updated "do_fetch" to have a link to "Fetchers" dev-manual, ref-manual: removed "distrodata" class ref-manual: Removed bugzilla.bbclass ref-manual: Removed "distutils-tools" class. ref-manual: Udated devtool help output examples. ref-manual: New section "Checking Upgrade Status of a Recipe" dev-manual: Added check-upgrade-status blurb to upgrading recipes ref-manual: do_checkpkg - added link to checking upgrade status ref-manual: Updates to check-recipe-upgrade devtool command ref-manual: Grammar correction dev-manual: Added new section for creating NPM packages Makefile: Updated to support new NPM package creation section dev-manual: Updated the "Working with Packages" list ref-manual: Updated "npm.bbclass" section. overview-manual: Updated SCM section dev-manual: Fixed grammar issue. Tim Orling (8): libxml-parser-perl: fix ptest dependencies perl-rdepends.txt: improve dependencies for perl module ptests perl: install Config_git.pl perl-rdepends.txt: fix perl-module-data-dumper dependencies python3-scons-{native}: add recipe for v3.0.5 scons.bbclass: use python3-scons serf: switch to python3-scons-native oeqa/runtime: add simple test for scons Tom Rini (2): vim: Rework things so vim adds features not vim-tiny removes vim: Update to 8.1.1518 to fix CVE-2019-12735 Yeoh Ee Peng (3): resulttool/resultutils: Enable add extra configurations to results resulttool/store: Enable add EXECUTED_BY config to results resulttool/merge: Enable control TESTSERIES and extra configurations Zang Ruochen (3): openssh: Upgrade 7.9p1 -> 8.0p1 dbus: Upgrade 1.12.12 -> 1.12.14 dbus-test: Upgrade 1.12.12 -> 1.12.14 Zhixiong Chi (2): gcc: reduce the variables in symtab gcc: CVE-2018-12886 sangeeta jain (1): resulttool/manualexecution: Enable creation of test case configuration meta-raspberrypi: 7059c37451..40283f583b: Andrei Gherzan (1): gstreamer1.0-omx: Forward port bbappend and patches to v1.16.x Khem Raj (4): linux-raspberrypi_4.19.bb: Update to 4.19.44 rpi-default-versions: Switch defaults to 4.19 userland: Update to 20190501 firmware: Update 20190220 -> 20190517 malus-brandywine (1): sdcard_image-rpi : minor bug in use of FATPAYLOAD Change-Id: Idab4e8c2666bc776d0b47988a32dcb9f04885aff Signed-off-by: Brad Bishop --- ...ve-progressmeter-force-an-update-at-the-b.patch | 121 --------- .../openssh/openssh/CVE-2018-20685.patch | 40 --- .../openssh/openssh/CVE-2019-6109.patch | 275 --------------------- .../openssh/openssh/CVE-2019-6111.patch | 187 -------------- ...ial-signed-overflow-in-pointer-arithmatic.patch | 26 +- .../recipes-connectivity/openssh/openssh_7.9p1.bb | 167 ------------- .../recipes-connectivity/openssh/openssh_8.0p1.bb | 164 ++++++++++++ 7 files changed, 183 insertions(+), 797 deletions(-) delete mode 100644 poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-Have-progressmeter-force-an-update-at-the-b.patch delete mode 100644 poky/meta/recipes-connectivity/openssh/openssh/CVE-2018-20685.patch delete mode 100644 poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch delete mode 100644 poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6111.patch delete mode 100644 poky/meta/recipes-connectivity/openssh/openssh_7.9p1.bb create mode 100644 poky/meta/recipes-connectivity/openssh/openssh_8.0p1.bb (limited to 'poky/meta/recipes-connectivity/openssh') diff --git a/poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-Have-progressmeter-force-an-update-at-the-b.patch b/poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-Have-progressmeter-force-an-update-at-the-b.patch deleted file mode 100644 index 4c9d57442..000000000 --- a/poky/meta/recipes-connectivity/openssh/openssh/0001-upstream-Have-progressmeter-force-an-update-at-the-b.patch +++ /dev/null @@ -1,121 +0,0 @@ -From 5df934e2279e8ed1f07b990f4b2b3baf6470f7e5 Mon Sep 17 00:00:00 2001 -From: "dtucker@openbsd.org" -Date: Thu, 24 Jan 2019 16:52:17 +0000 -Subject: [PATCH] upstream: Have progressmeter force an update at the beginning - and - -end of each transfer. Fixes the problem recently introduces where very quick -transfers do not display the progressmeter at all. Spotted by naddy@ - -OpenBSD-Commit-ID: 68dc46c259e8fdd4f5db3ec2a130f8e4590a7a9a -Upstream-Status: Backport -Signed-off-by: Anuj Mittal ---- - progressmeter.c | 13 +++++-------- - progressmeter.h | 4 ++-- - scp.c | 2 +- - sftp-client.c | 2 +- - 4 files changed, 9 insertions(+), 12 deletions(-) - -diff --git a/progressmeter.c b/progressmeter.c -index add462d..e385c12 100644 ---- a/progressmeter.c -+++ b/progressmeter.c -@@ -1,4 +1,4 @@ --/* $OpenBSD: progressmeter.c,v 1.46 2019/01/23 08:01:46 dtucker Exp $ */ -+/* $OpenBSD: progressmeter.c,v 1.47 2019/01/24 16:52:17 dtucker Exp $ */ - /* - * Copyright (c) 2003 Nils Nordman. All rights reserved. - * -@@ -59,9 +59,6 @@ static void format_rate(char *, int, off_t); - static void sig_winch(int); - static void setscreensize(void); - --/* updates the progressmeter to reflect the current state of the transfer */ --void refresh_progress_meter(void); -- - /* signal handler for updating the progress meter */ - static void sig_alarm(int); - -@@ -120,7 +117,7 @@ format_size(char *buf, int size, off_t bytes) - } - - void --refresh_progress_meter(void) -+refresh_progress_meter(int force_update) - { - char buf[MAX_WINSIZE + 1]; - off_t transferred; -@@ -131,7 +128,7 @@ refresh_progress_meter(void) - int hours, minutes, seconds; - int file_len; - -- if ((!alarm_fired && !win_resized) || !can_output()) -+ if ((!force_update && !alarm_fired && !win_resized) || !can_output()) - return; - alarm_fired = 0; - -@@ -254,7 +251,7 @@ start_progress_meter(const char *f, off_t filesize, off_t *ctr) - bytes_per_second = 0; - - setscreensize(); -- refresh_progress_meter(); -+ refresh_progress_meter(1); - - signal(SIGALRM, sig_alarm); - signal(SIGWINCH, sig_winch); -@@ -271,7 +268,7 @@ stop_progress_meter(void) - - /* Ensure we complete the progress */ - if (cur_pos != end_pos) -- refresh_progress_meter(); -+ refresh_progress_meter(1); - - atomicio(vwrite, STDOUT_FILENO, "\n", 1); - } -diff --git a/progressmeter.h b/progressmeter.h -index 8f66780..1703ea7 100644 ---- a/progressmeter.h -+++ b/progressmeter.h -@@ -1,4 +1,4 @@ --/* $OpenBSD: progressmeter.h,v 1.4 2019/01/23 08:01:46 dtucker Exp $ */ -+/* $OpenBSD: progressmeter.h,v 1.5 2019/01/24 16:52:17 dtucker Exp $ */ - /* - * Copyright (c) 2002 Nils Nordman. All rights reserved. - * -@@ -24,5 +24,5 @@ - */ - - void start_progress_meter(const char *, off_t, off_t *); --void refresh_progress_meter(void); -+void refresh_progress_meter(int); - void stop_progress_meter(void); -diff --git a/scp.c b/scp.c -index 4a342a6..0587cec 100644 ---- a/scp.c -+++ b/scp.c -@@ -585,7 +585,7 @@ scpio(void *_cnt, size_t s) - off_t *cnt = (off_t *)_cnt; - - *cnt += s; -- refresh_progress_meter(); -+ refresh_progress_meter(0); - if (limit_kbps > 0) - bandwidth_limit(&bwlimit, s); - return 0; -diff --git a/sftp-client.c b/sftp-client.c -index 2bc698f..cf2887a 100644 ---- a/sftp-client.c -+++ b/sftp-client.c -@@ -101,7 +101,7 @@ sftpio(void *_bwlimit, size_t amount) - { - struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit; - -- refresh_progress_meter(); -+ refresh_progress_meter(0); - if (bwlimit != NULL) - bandwidth_limit(bwlimit, amount); - return 0; --- -2.7.4 - diff --git a/poky/meta/recipes-connectivity/openssh/openssh/CVE-2018-20685.patch b/poky/meta/recipes-connectivity/openssh/openssh/CVE-2018-20685.patch deleted file mode 100644 index c5b3baece..000000000 --- a/poky/meta/recipes-connectivity/openssh/openssh/CVE-2018-20685.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 6010c0303a422a9c5fa8860c061bf7105eb7f8b2 Mon Sep 17 00:00:00 2001 -From: "djm@openbsd.org" -Date: Fri, 16 Nov 2018 03:03:10 +0000 -Subject: [PATCH] upstream: disallow empty incoming filename or ones that refer - to the - -current directory; based on report/patch from Harry Sintonen - -OpenBSD-Commit-ID: f27651b30eaee2df49540ab68d030865c04f6de9 - -CVE: CVE-2018-20685 -Upstream-Status: Backport -Signed-off-by: Anuj Mittal ---- - scp.c | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/scp.c b/scp.c -index 60682c6..4f3fdcd 100644 ---- a/scp.c -+++ b/scp.c -@@ -1,4 +1,4 @@ --/* $OpenBSD: scp.c,v 1.197 2018/06/01 04:31:48 dtucker Exp $ */ -+/* $OpenBSD: scp.c,v 1.198 2018/11/16 03:03:10 djm Exp $ */ - /* - * scp - secure remote copy. This is basically patched BSD rcp which - * uses ssh to do the data transfer (instead of using rcmd). -@@ -1106,7 +1106,8 @@ sink(int argc, char **argv) - SCREWUP("size out of range"); - size = (off_t)ull; - -- if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) { -+ if (*cp == '\0' || strchr(cp, '/') != NULL || -+ strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) { - run_err("error: unexpected filename: %s", cp); - exit(1); - } --- -2.7.4 - diff --git a/poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch b/poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch deleted file mode 100644 index dabe4a6c9..000000000 --- a/poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6109.patch +++ /dev/null @@ -1,275 +0,0 @@ -From 15d47c3bd8551521240bc459fc004c280daef817 Mon Sep 17 00:00:00 2001 -From: "dtucker@openbsd.org" -Date: Wed, 23 Jan 2019 08:01:46 +0000 -Subject: [PATCH] upstream: Sanitize scp filenames via snmprintf. To do this we - move - -the progressmeter formatting outside of signal handler context and have the -atomicio callback called for EINTR too. bz#2434 with contributions from djm -and jjelen at redhat.com, ok djm@ - -OpenBSD-Commit-ID: 1af61c1f70e4f3bd8ab140b9f1fa699481db57d8 -CVE: CVE-2019-6109 -Upstream-Status: Backport -Signed-off-by: Anuj Mittal ---- - atomicio.c | 20 +++++++++++++++----- - progressmeter.c | 53 ++++++++++++++++++++++++----------------------------- - progressmeter.h | 3 ++- - scp.c | 1 + - sftp-client.c | 16 +++++++++------- - 5 files changed, 51 insertions(+), 42 deletions(-) - -diff --git a/atomicio.c b/atomicio.c -index f854a06..d91bd76 100644 ---- a/atomicio.c -+++ b/atomicio.c -@@ -1,4 +1,4 @@ --/* $OpenBSD: atomicio.c,v 1.28 2016/07/27 23:18:12 djm Exp $ */ -+/* $OpenBSD: atomicio.c,v 1.29 2019/01/23 08:01:46 dtucker Exp $ */ - /* - * Copyright (c) 2006 Damien Miller. All rights reserved. - * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved. -@@ -65,9 +65,14 @@ atomicio6(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n, - res = (f) (fd, s + pos, n - pos); - switch (res) { - case -1: -- if (errno == EINTR) -+ if (errno == EINTR) { -+ /* possible SIGALARM, update callback */ -+ if (cb != NULL && cb(cb_arg, 0) == -1) { -+ errno = EINTR; -+ return pos; -+ } - continue; -- if (errno == EAGAIN || errno == EWOULDBLOCK) { -+ } else if (errno == EAGAIN || errno == EWOULDBLOCK) { - #ifndef BROKEN_READ_COMPARISON - (void)poll(&pfd, 1, -1); - #endif -@@ -122,9 +127,14 @@ atomiciov6(ssize_t (*f) (int, const struct iovec *, int), int fd, - res = (f) (fd, iov, iovcnt); - switch (res) { - case -1: -- if (errno == EINTR) -+ if (errno == EINTR) { -+ /* possible SIGALARM, update callback */ -+ if (cb != NULL && cb(cb_arg, 0) == -1) { -+ errno = EINTR; -+ return pos; -+ } - continue; -- if (errno == EAGAIN || errno == EWOULDBLOCK) { -+ } else if (errno == EAGAIN || errno == EWOULDBLOCK) { - #ifndef BROKEN_READV_COMPARISON - (void)poll(&pfd, 1, -1); - #endif -diff --git a/progressmeter.c b/progressmeter.c -index fe9bf52..add462d 100644 ---- a/progressmeter.c -+++ b/progressmeter.c -@@ -1,4 +1,4 @@ --/* $OpenBSD: progressmeter.c,v 1.45 2016/06/30 05:17:05 dtucker Exp $ */ -+/* $OpenBSD: progressmeter.c,v 1.46 2019/01/23 08:01:46 dtucker Exp $ */ - /* - * Copyright (c) 2003 Nils Nordman. All rights reserved. - * -@@ -31,6 +31,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -39,6 +40,7 @@ - #include "progressmeter.h" - #include "atomicio.h" - #include "misc.h" -+#include "utf8.h" - - #define DEFAULT_WINSIZE 80 - #define MAX_WINSIZE 512 -@@ -61,7 +63,7 @@ static void setscreensize(void); - void refresh_progress_meter(void); - - /* signal handler for updating the progress meter */ --static void update_progress_meter(int); -+static void sig_alarm(int); - - static double start; /* start progress */ - static double last_update; /* last progress update */ -@@ -74,6 +76,7 @@ static long stalled; /* how long we have been stalled */ - static int bytes_per_second; /* current speed in bytes per second */ - static int win_size; /* terminal window size */ - static volatile sig_atomic_t win_resized; /* for window resizing */ -+static volatile sig_atomic_t alarm_fired; - - /* units for format_size */ - static const char unit[] = " KMGT"; -@@ -126,9 +129,17 @@ refresh_progress_meter(void) - off_t bytes_left; - int cur_speed; - int hours, minutes, seconds; -- int i, len; - int file_len; - -+ if ((!alarm_fired && !win_resized) || !can_output()) -+ return; -+ alarm_fired = 0; -+ -+ if (win_resized) { -+ setscreensize(); -+ win_resized = 0; -+ } -+ - transferred = *counter - (cur_pos ? cur_pos : start_pos); - cur_pos = *counter; - now = monotime_double(); -@@ -158,16 +169,11 @@ refresh_progress_meter(void) - - /* filename */ - buf[0] = '\0'; -- file_len = win_size - 35; -+ file_len = win_size - 36; - if (file_len > 0) { -- len = snprintf(buf, file_len + 1, "\r%s", file); -- if (len < 0) -- len = 0; -- if (len >= file_len + 1) -- len = file_len; -- for (i = len; i < file_len; i++) -- buf[i] = ' '; -- buf[file_len] = '\0'; -+ buf[0] = '\r'; -+ snmprintf(buf+1, sizeof(buf)-1 , &file_len, "%*s", -+ file_len * -1, file); - } - - /* percent of transfer done */ -@@ -228,22 +234,11 @@ refresh_progress_meter(void) - - /*ARGSUSED*/ - static void --update_progress_meter(int ignore) -+sig_alarm(int ignore) - { -- int save_errno; -- -- save_errno = errno; -- -- if (win_resized) { -- setscreensize(); -- win_resized = 0; -- } -- if (can_output()) -- refresh_progress_meter(); -- -- signal(SIGALRM, update_progress_meter); -+ signal(SIGALRM, sig_alarm); -+ alarm_fired = 1; - alarm(UPDATE_INTERVAL); -- errno = save_errno; - } - - void -@@ -259,10 +254,9 @@ start_progress_meter(const char *f, off_t filesize, off_t *ctr) - bytes_per_second = 0; - - setscreensize(); -- if (can_output()) -- refresh_progress_meter(); -+ refresh_progress_meter(); - -- signal(SIGALRM, update_progress_meter); -+ signal(SIGALRM, sig_alarm); - signal(SIGWINCH, sig_winch); - alarm(UPDATE_INTERVAL); - } -@@ -286,6 +280,7 @@ stop_progress_meter(void) - static void - sig_winch(int sig) - { -+ signal(SIGWINCH, sig_winch); - win_resized = 1; - } - -diff --git a/progressmeter.h b/progressmeter.h -index bf179dc..8f66780 100644 ---- a/progressmeter.h -+++ b/progressmeter.h -@@ -1,4 +1,4 @@ --/* $OpenBSD: progressmeter.h,v 1.3 2015/01/14 13:54:13 djm Exp $ */ -+/* $OpenBSD: progressmeter.h,v 1.4 2019/01/23 08:01:46 dtucker Exp $ */ - /* - * Copyright (c) 2002 Nils Nordman. All rights reserved. - * -@@ -24,4 +24,5 @@ - */ - - void start_progress_meter(const char *, off_t, off_t *); -+void refresh_progress_meter(void); - void stop_progress_meter(void); -diff --git a/scp.c b/scp.c -index 4f3fdcd..4a342a6 100644 ---- a/scp.c -+++ b/scp.c -@@ -585,6 +585,7 @@ scpio(void *_cnt, size_t s) - off_t *cnt = (off_t *)_cnt; - - *cnt += s; -+ refresh_progress_meter(); - if (limit_kbps > 0) - bandwidth_limit(&bwlimit, s); - return 0; -diff --git a/sftp-client.c b/sftp-client.c -index 4986d6d..2bc698f 100644 ---- a/sftp-client.c -+++ b/sftp-client.c -@@ -101,7 +101,9 @@ sftpio(void *_bwlimit, size_t amount) - { - struct bwlimit *bwlimit = (struct bwlimit *)_bwlimit; - -- bandwidth_limit(bwlimit, amount); -+ refresh_progress_meter(); -+ if (bwlimit != NULL) -+ bandwidth_limit(bwlimit, amount); - return 0; - } - -@@ -121,8 +123,8 @@ send_msg(struct sftp_conn *conn, struct sshbuf *m) - iov[1].iov_base = (u_char *)sshbuf_ptr(m); - iov[1].iov_len = sshbuf_len(m); - -- if (atomiciov6(writev, conn->fd_out, iov, 2, -- conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_out) != -+ if (atomiciov6(writev, conn->fd_out, iov, 2, sftpio, -+ conn->limit_kbps > 0 ? &conn->bwlimit_out : NULL) != - sshbuf_len(m) + sizeof(mlen)) - fatal("Couldn't send packet: %s", strerror(errno)); - -@@ -138,8 +140,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial) - - if ((r = sshbuf_reserve(m, 4, &p)) != 0) - fatal("%s: buffer error: %s", __func__, ssh_err(r)); -- if (atomicio6(read, conn->fd_in, p, 4, -- conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) != 4) { -+ if (atomicio6(read, conn->fd_in, p, 4, sftpio, -+ conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) != 4) { - if (errno == EPIPE || errno == ECONNRESET) - fatal("Connection closed"); - else -@@ -157,8 +159,8 @@ get_msg_extended(struct sftp_conn *conn, struct sshbuf *m, int initial) - - if ((r = sshbuf_reserve(m, msg_len, &p)) != 0) - fatal("%s: buffer error: %s", __func__, ssh_err(r)); -- if (atomicio6(read, conn->fd_in, p, msg_len, -- conn->limit_kbps > 0 ? sftpio : NULL, &conn->bwlimit_in) -+ if (atomicio6(read, conn->fd_in, p, msg_len, sftpio, -+ conn->limit_kbps > 0 ? &conn->bwlimit_in : NULL) - != msg_len) { - if (errno == EPIPE) - fatal("Connection closed"); --- -2.7.4 - diff --git a/poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6111.patch b/poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6111.patch deleted file mode 100644 index e498da381..000000000 --- a/poky/meta/recipes-connectivity/openssh/openssh/CVE-2019-6111.patch +++ /dev/null @@ -1,187 +0,0 @@ -From 15cc3497367d2e9729353b3df75518548e845c82 Mon Sep 17 00:00:00 2001 -From: "djm@openbsd.org" -Date: Sat, 26 Jan 2019 22:41:28 +0000 -Subject: [PATCH] upstream: check in scp client that filenames sent during - -remote->local directory copies satisfy the wildcard specified by the user. - -This checking provides some protection against a malicious server -sending unexpected filenames, but it comes at a risk of rejecting wanted -files due to differences between client and server wildcard expansion rules. - -For this reason, this also adds a new -T flag to disable the check. - -reported by Harry Sintonen -fix approach suggested by markus@; -has been in snaps for ~1wk courtesy deraadt@ - -OpenBSD-Commit-ID: 00f44b50d2be8e321973f3c6d014260f8f7a8eda - -CVE: CVE-2019-6111 -Upstream-Status: Backport -Signed-off-by: Anuj Mittal ---- - scp.1 | 12 +++++++++++- - scp.c | 37 +++++++++++++++++++++++++++++-------- - 2 files changed, 40 insertions(+), 9 deletions(-) - -diff --git a/scp.1 b/scp.1 -index 0e5cc1b..397e770 100644 ---- a/scp.1 -+++ b/scp.1 -@@ -18,7 +18,7 @@ - .Nd secure copy (remote file copy program) - .Sh SYNOPSIS - .Nm scp --.Op Fl 346BCpqrv -+.Op Fl 346BCpqrTv - .Op Fl c Ar cipher - .Op Fl F Ar ssh_config - .Op Fl i Ar identity_file -@@ -208,6 +208,16 @@ to use for the encrypted connection. - The program must understand - .Xr ssh 1 - options. -+.It Fl T -+Disable strict filename checking. -+By default when copying files from a remote host to a local directory -+.Nm -+checks that the received filenames match those requested on the command-line -+to prevent the remote end from sending unexpected or unwanted files. -+Because of differences in how various operating systems and shells interpret -+filename wildcards, these checks may cause wanted files to be rejected. -+This option disables these checks at the expense of fully trusting that -+the server will not send unexpected filenames. - .It Fl v - Verbose mode. - Causes -diff --git a/scp.c b/scp.c -index 0587cec..b2d331e 100644 ---- a/scp.c -+++ b/scp.c -@@ -94,6 +94,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -375,14 +376,14 @@ void verifydir(char *); - struct passwd *pwd; - uid_t userid; - int errs, remin, remout; --int pflag, iamremote, iamrecursive, targetshouldbedirectory; -+int Tflag, pflag, iamremote, iamrecursive, targetshouldbedirectory; - - #define CMDNEEDS 64 - char cmd[CMDNEEDS]; /* must hold "rcp -r -p -d\0" */ - - int response(void); - void rsource(char *, struct stat *); --void sink(int, char *[]); -+void sink(int, char *[], const char *); - void source(int, char *[]); - void tolocal(int, char *[]); - void toremote(int, char *[]); -@@ -421,8 +422,9 @@ main(int argc, char **argv) - addargs(&args, "-oRemoteCommand=none"); - addargs(&args, "-oRequestTTY=no"); - -- fflag = tflag = 0; -- while ((ch = getopt(argc, argv, "dfl:prtvBCc:i:P:q12346S:o:F:")) != -1) -+ fflag = Tflag = tflag = 0; -+ while ((ch = getopt(argc, argv, -+ "dfl:prtTvBCc:i:P:q12346S:o:F:")) != -1) { - switch (ch) { - /* User-visible flags. */ - case '1': -@@ -501,9 +503,13 @@ main(int argc, char **argv) - setmode(0, O_BINARY); - #endif - break; -+ case 'T': -+ Tflag = 1; -+ break; - default: - usage(); - } -+ } - argc -= optind; - argv += optind; - -@@ -534,7 +540,7 @@ main(int argc, char **argv) - } - if (tflag) { - /* Receive data. */ -- sink(argc, argv); -+ sink(argc, argv, NULL); - exit(errs != 0); - } - if (argc < 2) -@@ -792,7 +798,7 @@ tolocal(int argc, char **argv) - continue; - } - free(bp); -- sink(1, argv + argc - 1); -+ sink(1, argv + argc - 1, src); - (void) close(remin); - remin = remout = -1; - } -@@ -968,7 +974,7 @@ rsource(char *name, struct stat *statp) - (sizeof(type) != 4 && sizeof(type) != 8)) - - void --sink(int argc, char **argv) -+sink(int argc, char **argv, const char *src) - { - static BUF buffer; - struct stat stb; -@@ -984,6 +990,7 @@ sink(int argc, char **argv) - unsigned long long ull; - int setimes, targisdir, wrerrno = 0; - char ch, *cp, *np, *targ, *why, *vect[1], buf[2048], visbuf[2048]; -+ char *src_copy = NULL, *restrict_pattern = NULL; - struct timeval tv[2]; - - #define atime tv[0] -@@ -1008,6 +1015,17 @@ sink(int argc, char **argv) - (void) atomicio(vwrite, remout, "", 1); - if (stat(targ, &stb) == 0 && S_ISDIR(stb.st_mode)) - targisdir = 1; -+ if (src != NULL && !iamrecursive && !Tflag) { -+ /* -+ * Prepare to try to restrict incoming filenames to match -+ * the requested destination file glob. -+ */ -+ if ((src_copy = strdup(src)) == NULL) -+ fatal("strdup failed"); -+ if ((restrict_pattern = strrchr(src_copy, '/')) != NULL) { -+ *restrict_pattern++ = '\0'; -+ } -+ } - for (first = 1;; first = 0) { - cp = buf; - if (atomicio(read, remin, cp, 1) != 1) -@@ -1112,6 +1130,9 @@ sink(int argc, char **argv) - run_err("error: unexpected filename: %s", cp); - exit(1); - } -+ if (restrict_pattern != NULL && -+ fnmatch(restrict_pattern, cp, 0) != 0) -+ SCREWUP("filename does not match request"); - if (targisdir) { - static char *namebuf; - static size_t cursize; -@@ -1149,7 +1170,7 @@ sink(int argc, char **argv) - goto bad; - } - vect[0] = xstrdup(np); -- sink(1, vect); -+ sink(1, vect, src); - if (setimes) { - setimes = 0; - if (utimes(vect[0], tv) < 0) --- -2.7.4 - diff --git a/poky/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch b/poky/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch index 7e043a2db..20036da93 100644 --- a/poky/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch +++ b/poky/meta/recipes-connectivity/openssh/openssh/fix-potential-signed-overflow-in-pointer-arithmatic.patch @@ -11,14 +11,17 @@ would lead to program abort. Upstream-Status: Submitted [http://bugzilla.mindrot.org/show_bug.cgi?id=2608] Signed-off-by: Yuanjie Huang + +Complete the fix +Signed-off-by: Hongxu Jia --- - openbsd-compat/strlcat.c | 8 ++++++-- - openbsd-compat/strlcpy.c | 8 ++++++-- - openbsd-compat/strnlen.c | 8 ++++++-- - 3 files changed, 18 insertions(+), 6 deletions(-) + openbsd-compat/strlcat.c | 10 +++++++--- + openbsd-compat/strlcpy.c | 8 ++++++-- + openbsd-compat/strnlen.c | 8 ++++++-- + 3 files changed, 19 insertions(+), 7 deletions(-) diff --git a/openbsd-compat/strlcat.c b/openbsd-compat/strlcat.c -index bcc1b61..e758ebf 100644 +index bcc1b61..124e1e3 100644 --- a/openbsd-compat/strlcat.c +++ b/openbsd-compat/strlcat.c @@ -23,6 +23,7 @@ @@ -29,6 +32,15 @@ index bcc1b61..e758ebf 100644 /* * Appends src to string dst of size siz (unlike strncat, siz is the +@@ -42,7 +43,7 @@ strlcat(char *dst, const char *src, size_t siz) + /* Find the end of dst and adjust bytes left but don't go past end */ + while (n-- != 0 && *d != '\0') + d++; +- dlen = d - dst; ++ dlen = (uintptr_t)d - (uintptr_t)dst; + n = siz - dlen; + + if (n == 0) @@ -55,8 +56,11 @@ strlcat(char *dst, const char *src, size_t siz) s++; } @@ -70,7 +82,7 @@ index b4b1b60..b06f374 100644 #endif /* !HAVE_STRLCPY */ diff --git a/openbsd-compat/strnlen.c b/openbsd-compat/strnlen.c -index 93d5155..9b8de5d 100644 +index 7ad3573..7040f1f 100644 --- a/openbsd-compat/strnlen.c +++ b/openbsd-compat/strnlen.c @@ -23,6 +23,7 @@ @@ -95,5 +107,5 @@ index 93d5155..9b8de5d 100644 } #endif -- -1.9.1 +2.17.1 diff --git a/poky/meta/recipes-connectivity/openssh/openssh_7.9p1.bb b/poky/meta/recipes-connectivity/openssh/openssh_7.9p1.bb deleted file mode 100644 index 3b4ed7223..000000000 --- a/poky/meta/recipes-connectivity/openssh/openssh_7.9p1.bb +++ /dev/null @@ -1,167 +0,0 @@ -SUMMARY = "A suite of security-related network utilities based on \ -the SSH protocol including the ssh client and sshd server" -DESCRIPTION = "Secure rlogin/rsh/rcp/telnet replacement (OpenSSH) \ -Ssh (Secure Shell) is a program for logging into a remote machine \ -and for executing commands on a remote machine." -HOMEPAGE = "http://www.openssh.com/" -SECTION = "console/network" -LICENSE = "BSD" -LIC_FILES_CHKSUM = "file://LICENCE;md5=429658c6612f3a9b1293782366ab29d8" - -DEPENDS = "zlib openssl" -DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" - -SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \ - file://sshd_config \ - file://ssh_config \ - file://init \ - ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ - file://sshd.socket \ - file://sshd@.service \ - file://sshdgenkeys.service \ - file://volatiles.99_sshd \ - file://run-ptest \ - file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ - file://sshd_check_keys \ - file://add-test-support-for-busybox.patch \ - file://CVE-2018-20685.patch \ - file://CVE-2019-6109.patch \ - file://0001-upstream-Have-progressmeter-force-an-update-at-the-b.patch \ - file://CVE-2019-6111.patch \ - " -SRC_URI[md5sum] = "c6af50b7a474d04726a5aa747a5dce8f" -SRC_URI[sha256sum] = "6b4b3ba2253d84ed3771c8050728d597c91cfce898713beb7b64a305b6f11aad" - -PAM_SRC_URI = "file://sshd" - -inherit useradd update-rc.d update-alternatives systemd - -USERADD_PACKAGES = "${PN}-sshd" -USERADD_PARAM_${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd" -INITSCRIPT_PACKAGES = "${PN}-sshd" -INITSCRIPT_NAME_${PN}-sshd = "sshd" -INITSCRIPT_PARAMS_${PN}-sshd = "defaults 9" - -SYSTEMD_PACKAGES = "${PN}-sshd" -SYSTEMD_SERVICE_${PN}-sshd = "sshd.socket" - -inherit autotools-brokensep ptest - -EXTRA_AUTORECONF += "--exclude=aclocal" - -# login path is hardcoded in sshd -EXTRA_OECONF = "'LOGIN_PROGRAM=${base_bindir}/login' \ - ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--with-pam', '--without-pam', d)} \ - --without-zlib-version-check \ - --with-privsep-path=${localstatedir}/run/sshd \ - --sysconfdir=${sysconfdir}/ssh \ - --with-xauth=${bindir}/xauth \ - --disable-strip \ - " - -# musl doesn't implement wtmp/utmp -EXTRA_OECONF_append_libc-musl = " --disable-wtmp" - -# Since we do not depend on libbsd, we do not want configure to use it -# just because it finds libutil.h. But, specifying --disable-libutil -# causes compile errors, so... -CACHED_CONFIGUREVARS += "ac_cv_header_bsd_libutil_h=no ac_cv_header_libutil_h=no" - -# passwd path is hardcoded in sshd -CACHED_CONFIGUREVARS += "ac_cv_path_PATH_PASSWD_PROG=${bindir}/passwd" - -# We don't want to depend on libblockfile -CACHED_CONFIGUREVARS += "ac_cv_header_maillock_h=no" - -do_configure_prepend () { - export LD="${CC}" - install -m 0644 ${WORKDIR}/sshd_config ${B}/ - install -m 0644 ${WORKDIR}/ssh_config ${B}/ -} - -do_compile_ptest() { - # skip regress/unittests/ binaries: this will silently skip - # unittests in run-ptests which is good because they are so slow. - oe_runmake regress/modpipe regress/setuid-allowed regress/netcat \ - regress/check-perm regress/mkdtemp -} - -do_install_append () { - if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then - install -D -m 0644 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd - sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config - fi - - if [ "${@bb.utils.filter('DISTRO_FEATURES', 'x11', d)}" ]; then - sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config - fi - - install -d ${D}${sysconfdir}/init.d - install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/sshd - rm -f ${D}${bindir}/slogin ${D}${datadir}/Ssh.bin - rmdir ${D}${localstatedir}/run/sshd ${D}${localstatedir}/run ${D}${localstatedir} - install -d ${D}/${sysconfdir}/default/volatiles - install -m 644 ${WORKDIR}/volatiles.99_sshd ${D}/${sysconfdir}/default/volatiles/99_sshd - install -m 0755 ${S}/contrib/ssh-copy-id ${D}${bindir} - - # Create config files for read-only rootfs - install -d ${D}${sysconfdir}/ssh - install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly - sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly - echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly - echo "HostKey /var/run/ssh/ssh_host_ecdsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly - echo "HostKey /var/run/ssh/ssh_host_ed25519_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly - - install -d ${D}${systemd_unitdir}/system - install -c -m 0644 ${WORKDIR}/sshd.socket ${D}${systemd_unitdir}/system - install -c -m 0644 ${WORKDIR}/sshd@.service ${D}${systemd_unitdir}/system - install -c -m 0644 ${WORKDIR}/sshdgenkeys.service ${D}${systemd_unitdir}/system - sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \ - -e 's,@SBINDIR@,${sbindir},g' \ - -e 's,@BINDIR@,${bindir},g' \ - -e 's,@LIBEXECDIR@,${libexecdir}/${BPN},g' \ - ${D}${systemd_unitdir}/system/sshd.socket ${D}${systemd_unitdir}/system/*.service - - sed -i -e 's,@LIBEXECDIR@,${libexecdir}/${BPN},g' \ - ${D}${sysconfdir}/init.d/sshd - - install -D -m 0755 ${WORKDIR}/sshd_check_keys ${D}${libexecdir}/${BPN}/sshd_check_keys -} - -do_install_ptest () { - sed -i -e "s|^SFTPSERVER=.*|SFTPSERVER=${libexecdir}/sftp-server|" regress/test-exec.sh - cp -r regress ${D}${PTEST_PATH} -} - -ALLOW_EMPTY_${PN} = "1" - -PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server" -FILES_${PN}-scp = "${bindir}/scp.${BPN}" -FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config" -FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system" -FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd" -FILES_${PN}-sshd += "${libexecdir}/${BPN}/sshd_check_keys" -FILES_${PN}-sftp = "${bindir}/sftp" -FILES_${PN}-sftp-server = "${libexecdir}/sftp-server" -FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*" -FILES_${PN}-keygen = "${bindir}/ssh-keygen" - -RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen" -RDEPENDS_${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}" -RRECOMMENDS_${PN}-sshd_append_class-target = " rng-tools" -RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed" - -RPROVIDES_${PN}-ssh = "ssh" -RPROVIDES_${PN}-sshd = "sshd" - -RCONFLICTS_${PN} = "dropbear" -RCONFLICTS_${PN}-sshd = "dropbear" - -CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config" -CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config" - -ALTERNATIVE_PRIORITY = "90" -ALTERNATIVE_${PN}-scp = "scp" -ALTERNATIVE_${PN}-ssh = "ssh" - -BBCLASSEXTEND += "nativesdk" diff --git a/poky/meta/recipes-connectivity/openssh/openssh_8.0p1.bb b/poky/meta/recipes-connectivity/openssh/openssh_8.0p1.bb new file mode 100644 index 000000000..0a5c2ffae --- /dev/null +++ b/poky/meta/recipes-connectivity/openssh/openssh_8.0p1.bb @@ -0,0 +1,164 @@ +SUMMARY = "A suite of security-related network utilities based on \ +the SSH protocol including the ssh client and sshd server" +DESCRIPTION = "Secure rlogin/rsh/rcp/telnet replacement (OpenSSH) \ +Ssh (Secure Shell) is a program for logging into a remote machine \ +and for executing commands on a remote machine." +HOMEPAGE = "http://www.openssh.com/" +SECTION = "console/network" +LICENSE = "BSD" +LIC_FILES_CHKSUM = "file://LICENCE;md5=429658c6612f3a9b1293782366ab29d8" + +DEPENDS = "zlib openssl" +DEPENDS += "${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'libpam', '', d)}" + +SRC_URI = "http://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-${PV}.tar.gz \ + file://sshd_config \ + file://ssh_config \ + file://init \ + ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '${PAM_SRC_URI}', '', d)} \ + file://sshd.socket \ + file://sshd@.service \ + file://sshdgenkeys.service \ + file://volatiles.99_sshd \ + file://run-ptest \ + file://fix-potential-signed-overflow-in-pointer-arithmatic.patch \ + file://sshd_check_keys \ + file://add-test-support-for-busybox.patch \ + " +SRC_URI[md5sum] = "bf050f002fe510e1daecd39044e1122d" +SRC_URI[sha256sum] = "bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0b437320c3481fd68" + +PAM_SRC_URI = "file://sshd" + +inherit useradd update-rc.d update-alternatives systemd + +USERADD_PACKAGES = "${PN}-sshd" +USERADD_PARAM_${PN}-sshd = "--system --no-create-home --home-dir /var/run/sshd --shell /bin/false --user-group sshd" +INITSCRIPT_PACKAGES = "${PN}-sshd" +INITSCRIPT_NAME_${PN}-sshd = "sshd" +INITSCRIPT_PARAMS_${PN}-sshd = "defaults 9" + +SYSTEMD_PACKAGES = "${PN}-sshd" +SYSTEMD_SERVICE_${PN}-sshd = "sshd.socket" + +inherit autotools-brokensep ptest + +EXTRA_AUTORECONF += "--exclude=aclocal" + +# login path is hardcoded in sshd +EXTRA_OECONF = "'LOGIN_PROGRAM=${base_bindir}/login' \ + ${@bb.utils.contains('DISTRO_FEATURES', 'pam', '--with-pam', '--without-pam', d)} \ + --without-zlib-version-check \ + --with-privsep-path=${localstatedir}/run/sshd \ + --sysconfdir=${sysconfdir}/ssh \ + --with-xauth=${bindir}/xauth \ + --disable-strip \ + " + +# musl doesn't implement wtmp/utmp +EXTRA_OECONF_append_libc-musl = " --disable-wtmp" + +# Since we do not depend on libbsd, we do not want configure to use it +# just because it finds libutil.h. But, specifying --disable-libutil +# causes compile errors, so... +CACHED_CONFIGUREVARS += "ac_cv_header_bsd_libutil_h=no ac_cv_header_libutil_h=no" + +# passwd path is hardcoded in sshd +CACHED_CONFIGUREVARS += "ac_cv_path_PATH_PASSWD_PROG=${bindir}/passwd" + +# We don't want to depend on libblockfile +CACHED_CONFIGUREVARS += "ac_cv_header_maillock_h=no" + +do_configure_prepend () { + export LD="${CC}" + install -m 0644 ${WORKDIR}/sshd_config ${B}/ + install -m 0644 ${WORKDIR}/ssh_config ${B}/ +} + +do_compile_ptest() { + # skip regress/unittests/ binaries: this will silently skip + # unittests in run-ptests which is good because they are so slow. + oe_runmake regress/modpipe regress/setuid-allowed regress/netcat \ + regress/check-perm regress/mkdtemp +} + +do_install_append () { + if [ "${@bb.utils.filter('DISTRO_FEATURES', 'pam', d)}" ]; then + install -D -m 0644 ${WORKDIR}/sshd ${D}${sysconfdir}/pam.d/sshd + sed -i -e 's:#UsePAM no:UsePAM yes:' ${D}${sysconfdir}/ssh/sshd_config + fi + + if [ "${@bb.utils.filter('DISTRO_FEATURES', 'x11', d)}" ]; then + sed -i -e 's:#X11Forwarding no:X11Forwarding yes:' ${D}${sysconfdir}/ssh/sshd_config + fi + + install -d ${D}${sysconfdir}/init.d + install -m 0755 ${WORKDIR}/init ${D}${sysconfdir}/init.d/sshd + rm -f ${D}${bindir}/slogin ${D}${datadir}/Ssh.bin + rmdir ${D}${localstatedir}/run/sshd ${D}${localstatedir}/run ${D}${localstatedir} + install -d ${D}/${sysconfdir}/default/volatiles + install -m 644 ${WORKDIR}/volatiles.99_sshd ${D}/${sysconfdir}/default/volatiles/99_sshd + install -m 0755 ${S}/contrib/ssh-copy-id ${D}${bindir} + + # Create config files for read-only rootfs + install -d ${D}${sysconfdir}/ssh + install -m 644 ${D}${sysconfdir}/ssh/sshd_config ${D}${sysconfdir}/ssh/sshd_config_readonly + sed -i '/HostKey/d' ${D}${sysconfdir}/ssh/sshd_config_readonly + echo "HostKey /var/run/ssh/ssh_host_rsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly + echo "HostKey /var/run/ssh/ssh_host_ecdsa_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly + echo "HostKey /var/run/ssh/ssh_host_ed25519_key" >> ${D}${sysconfdir}/ssh/sshd_config_readonly + + install -d ${D}${systemd_unitdir}/system + install -c -m 0644 ${WORKDIR}/sshd.socket ${D}${systemd_unitdir}/system + install -c -m 0644 ${WORKDIR}/sshd@.service ${D}${systemd_unitdir}/system + install -c -m 0644 ${WORKDIR}/sshdgenkeys.service ${D}${systemd_unitdir}/system + sed -i -e 's,@BASE_BINDIR@,${base_bindir},g' \ + -e 's,@SBINDIR@,${sbindir},g' \ + -e 's,@BINDIR@,${bindir},g' \ + -e 's,@LIBEXECDIR@,${libexecdir}/${BPN},g' \ + ${D}${systemd_unitdir}/system/sshd.socket ${D}${systemd_unitdir}/system/*.service + + sed -i -e 's,@LIBEXECDIR@,${libexecdir}/${BPN},g' \ + ${D}${sysconfdir}/init.d/sshd + + install -D -m 0755 ${WORKDIR}/sshd_check_keys ${D}${libexecdir}/${BPN}/sshd_check_keys +} + +do_install_ptest () { + sed -i -e "s|^SFTPSERVER=.*|SFTPSERVER=${libexecdir}/sftp-server|" regress/test-exec.sh + cp -r regress ${D}${PTEST_PATH} +} + +ALLOW_EMPTY_${PN} = "1" + +PACKAGES =+ "${PN}-keygen ${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-sftp ${PN}-misc ${PN}-sftp-server" +FILES_${PN}-scp = "${bindir}/scp.${BPN}" +FILES_${PN}-ssh = "${bindir}/ssh.${BPN} ${sysconfdir}/ssh/ssh_config" +FILES_${PN}-sshd = "${sbindir}/sshd ${sysconfdir}/init.d/sshd ${systemd_unitdir}/system" +FILES_${PN}-sshd += "${sysconfdir}/ssh/moduli ${sysconfdir}/ssh/sshd_config ${sysconfdir}/ssh/sshd_config_readonly ${sysconfdir}/default/volatiles/99_sshd ${sysconfdir}/pam.d/sshd" +FILES_${PN}-sshd += "${libexecdir}/${BPN}/sshd_check_keys" +FILES_${PN}-sftp = "${bindir}/sftp" +FILES_${PN}-sftp-server = "${libexecdir}/sftp-server" +FILES_${PN}-misc = "${bindir}/ssh* ${libexecdir}/ssh*" +FILES_${PN}-keygen = "${bindir}/ssh-keygen" + +RDEPENDS_${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen" +RDEPENDS_${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}" +RRECOMMENDS_${PN}-sshd_append_class-target = " rng-tools" +# gdb would make attach-ptrace test pass rather than skip but not worth the build dependencies +RDEPENDS_${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed sudo coreutils" + +RPROVIDES_${PN}-ssh = "ssh" +RPROVIDES_${PN}-sshd = "sshd" + +RCONFLICTS_${PN} = "dropbear" +RCONFLICTS_${PN}-sshd = "dropbear" + +CONFFILES_${PN}-sshd = "${sysconfdir}/ssh/sshd_config" +CONFFILES_${PN}-ssh = "${sysconfdir}/ssh/ssh_config" + +ALTERNATIVE_PRIORITY = "90" +ALTERNATIVE_${PN}-scp = "scp" +ALTERNATIVE_${PN}-ssh = "ssh" + +BBCLASSEXTEND += "nativesdk" -- cgit v1.2.3