subtree updatesnanbield

meta-arm: 79c52afe74..9a4ae38e84:
  Emekcan Aras (1):
        arm-bsp/optee: Improve PIN counter handling robustness

  Harsimran Singh Tungal (2):
        corstone1000:arm-bsp/tftf: Fix tftf tests on mps3
        arm-bsp/tf-a-tests: fix corstone1000

  Ross Burton (2):
        arm-bsp/documentation: upgrade Sphinx slightly
        CI: use https: to fetch meta-virtualization

meta-openembedded: 2da6e1b0e4..da9063bdfb:
  Changqing Li (2):
        postgresql: upgrade 15.4 -> 15.5
        redis: upgrade 6.2.13 -> 6.2.14

  Khem Raj (1):
        webkitgtk3: upgrade 2.42.0 -> 2.42.1

  Meenali Gupta (1):
        nginx: upgrade 1.25.2 -> 1.25.3

  Mingli Yu (1):
        mariadb: Upgrade to 10.11.6

  Wang Mingyu (5):
        strongswan: upgrade 5.9.12 -> 5.9.13
        webkitgtk3: upgrade 2.42.1 -> 2.42.2
        webkitgtk3: upgrade 2.42.2 -> 2.42.3
        webkitgtk3: upgrade 2.42.3 -> 2.42.4
        libssh: upgrade 0.10.5 -> 0.10.6

  Yi Zhao (1):
        samba: upgrade 4.18.8 -> 4.18.9

poky: 61a59d00a0..1a5c00f00c:
  Alassane Yattara (1):
        bitbake: toaster/toastergui: Bug-fix verify given layer path only if import/add local layer

  Alexander Kanavin (2):
        glibc-y2038-tests: do not run tests using 32 bit time APIs
        icon-naming-utils: take tarball from debian

  Alexander Sverdlin (1):
        linux-firmware: upgrade 20231030 -> 20231211

  Anuj Mittal (2):
        base-passwd: upgrade 3.6.2 -> 3.6.3
        glib-2.0: upgrade 2.78.1 -> 2.78.3

  Baruch Siach (1):
        contributor-guide: fix lore URL

  Benjamin Bara (1):
        glibc: stable 2.38 branch updates

  Bruce Ashfield (8):
        linux-yocto/6.1: update to v6.1.69
        linux-yocto/6.1: update to v6.1.70
        linux-yocto/6.1: update CVE exclusions
        linux-yocto/6.1: update to v6.1.72
        linux-yocto/6.1: update CVE exclusions
        linux-yocto/6.1: security/cfg: add configs to harden protection
        linux-yocto/6.1: update to v6.1.73
        linux-yocto/6.1: update CVE exclusions

  Chen Qi (2):
        sudo: upgrade from 1.9.15p2 to 1.9.15p5
        multilib_global.bbclass: fix parsing error with no kernel module split

  Clay Chang (1):
        devtool: deploy: provide max_process to strip_execs

  Enguerrand de Ribaucourt (1):
        manuals: document VSCode extension

  Ilya A. Kriveshko (1):
        dev-manual: update license manifest path

  Jason Andryuk (3):
        linux-firmware: Package iwlwifi .pnvm files
        linux-firmware: Change bnx2 packaging
        linux-firmware: Create bnx2x subpackage

  Jeremy A. Puhlman (1):
        create-spdx-2.2: combine spdx can try to write before dir creation

  Joao Marcos Costa (1):
        documentation.conf: fix do_menuconfig description

  Jonathan GUILLOT (1):
        udev-extraconf: fix unmount directories containing octal-escaped chars

  Jose Quaresma (2):
        go: update 1.20.10 -> 1.20.11
        go: update 1.20.11 -> 1.20.12

  Joshua Watt (2):
        rpcbind: Specify state directory under /run
        classes-global/sstate: Fix variable typo

  Julien Stephan (1):
        externalsrc: fix task dependency for do_populate_lic

  Jörg Sommer (1):
        documentation: Add UBOOT_BINARY, extend UBOOT_CONFIG

  Kai Kang (1):
        xserver-xorg: 21.1.9 -> 21.1.11

  Khem Raj (2):
        tiff: Backport fixes for CVE-2023-6277
        tcl: Fix prepending to run-ptest script

  Lee Chee Yang (5):
        curl: Fix CVE-2023-46219
        qemu: 8.1.2 -> 8.1.4
        migration-guide: add release notes for 4.3.2
        migration-guide: add release notes for 4.0.16
        migration-guide: add release notes for 4.3.3

  Markus Volk (1):
        libadwaita: update 1.4.0 -> 1.4.2

  Massimiliano Minella (1):
        zstd: fix LICENSE statement

  Maxin B. John (1):
        ref-manual: classes: remove insserv bbclass

  Michael Opdenacker (3):
        contributor-guide: use "apt" instead of "aptitude"
        release-notes-4.3: fix spacing
        migration-guides: fix release notes for 4.3.3

  Ming Liu (2):
        grub: fs/fat: Don't error when mtime is 0
        qemu.bbclass: fix a python TypeError

  Mingli Yu (1):
        python3-license-expression: Fix the ptest failure

  Peter Kjellerstedt (1):
        devtool: modify: Handle recipes with a menuconfig task correctly

  Peter Marko (4):
        dtc: preserve version also from shallow git clones
        sqlite3: upgrade 3.43.1 -> 3.43.2
        sqlite: drop obsolete CVE ignore
        zlib: ignore CVE-2023-6992

  Richard Purdie (9):
        pseudo: Update to pull in syncfs probe fix
        sstate: Fix dir ownership issues in SSTATE_DIR
        curl: Disable two intermittently failing tests
        lib/prservice: Improve lock handling robustness
        oeqa/selftest/prservice: Improve test robustness
        curl: Disable test 1091 due to intermittent failures
        allarch: Fix allarch corner case
        reproducible: Fix race with externalsrc/devtool over lockfile
        pseudo: Update to pull in gcc14 fix and missing statvfs64 intercept

  Robert Berger (1):
        uninative-tarball.xz - reproducibility fix

  Robert Joslyn (1):
        gtk: Set CVE_PRODUCT

  Robert Yang (2):
        nfs-utils: Upgrade 2.6.3 -> 2.6.4
        nfs-utils: Update Upstream-Status

  Rodrigo M. Duarte (1):
        linux-firmware: Fix the linux-firmware-bcm4373 FILES variable

  Ross Burton (4):
        avahi: update URL for new project location
        libssh2: backport fix for CVE-2023-48795
        cve_check: handle CVE_STATUS being set to the empty string
        cve_check: cleanup logging

  Saul Wold (1):
        package.py: OEHasPackage: Add MLPREFIX to packagename

  Simone Weiß (5):
        dev-manual: start.rst: Update use of Download page
        dev-manual: start.rst: Update use of Download page
        glibc: Set status for CVE-2023-5156 & CVE-2023-0687
        dev-manual: gen-tapdevs need iptables installed
        gcc: Update status of CVE-2023-4039

  Soumya Sambu (1):
        ncurses: Fix - tty is hung after reset

  Steve Sakoman (2):
        poky.conf: bump version for 4.3.3 release
        build-appliance-image: Update to nanbield head revision

  Trevor Gamblin (1):
        scripts/runqemu: fix regex escape sequences

  Wang Mingyu (9):
        xwayland: upgrade 23.2.2 -> 23.2.3
        libatomic-ops: upgrade 7.8.0 -> 7.8.2
        libva-utils: upgrade 2.20.0 -> 2.20.1
        kea: upgrade 2.4.0 -> 2.4.1
        gstreamer1.0: upgrade 1.22.7 -> 1.22.8
        aspell: upgrade 0.60.8 -> 0.60.8.1
        at-spi2-core: upgrade 2.50.0 -> 2.50.1
        cpio: upgrade 2.14 -> 2.15
        gstreamer: upgrade 1.22.8 -> 1.22.9

  William Lyu (1):
        elfutils: Update license information

  Xiangyu Chen (2):
        shadow: Fix for CVE-2023-4641
        sudo: upgrade 1.9.14p3 -> 1.9.15p2

  Yang Xu (1):
        rootfs.py: check depmodwrapper execution result

  Yogita Urade (2):
        tiff: fix CVE-2023-6228
        tiff: fix CVE-2023-52355 and CVE-2023-52356

  Zahir Hussain (1):
        cmake: Unset CMAKE_CXX_IMPLICIT_INCLUDE_DIRECTORIES

  baruch@tkos.co.il (1):
        overlayfs: add missing closing parenthesis in selftest

Change-Id: I613697694d0eb51ae9451f7e869b69d6c1ba1fd3
Signed-off-by: Patrick Williams <patrick@stwcx.xyz>

1 files changed, 183 insertions, 0 deletions

diff --git a/meta-openembedded/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.42.4.bb b/meta-openembedded/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.42.4.bb
new file mode 100644
index 0000000000..3c6b7db811
--- /dev/null
+++ b/meta-openembedded/meta-oe/recipes-support/webkitgtk/webkitgtk3_2.42.4.bb
@@ -0,0 +1,183 @@
+SUMMARY = "WebKit web rendering engine for the GTK+ platform"
+HOMEPAGE = "https://www.webkitgtk.org/"
+BUGTRACKER = "https://bugs.webkit.org/"
+
+LICENSE = "BSD-2-Clause & LGPL-2.0-or-later"
+LIC_FILES_CHKSUM = "file://Source/JavaScriptCore/COPYING.LIB;md5=d0c6d6397a5d84286dda758da57bd691 \
+                    file://Source/WebCore/LICENSE-APPLE;md5=4646f90082c40bcf298c285f8bab0b12 \
+                    file://Source/WebCore/LICENSE-LGPL-2;md5=36357ffde2b64ae177b2494445b79d21 \
+                    file://Source/WebCore/LICENSE-LGPL-2.1;md5=a778a33ef338abbaf8b8a7c36b6eec80 \
+                    "
+
+SRC_URI = "https://www.webkitgtk.org/releases/webkitgtk-${PV}.tar.xz \
+           file://0001-FindGObjectIntrospection.cmake-prefix-variables-obta.patch \
+           file://reproducibility.patch \
+           file://0d3344e17d258106617b0e6d783d073b188a2548.patch \
+           file://no-musttail-arm.patch \
+           "
+SRC_URI[sha256sum] = "52288b30bda22373442cecb86f9c9a569ad8d4769a1f97b352290ed92a67ed86"
+
+inherit cmake pkgconfig gobject-introspection perlnative features_check upstream-version-is-even gi-docgen
+
+S = "${WORKDIR}/webkitgtk-${PV}"
+
+ANY_OF_DISTRO_FEATURES = "${GTK3DISTROFEATURES}"
+REQUIRED_DISTRO_FEATURES = "${@bb.utils.contains('DISTRO_FEATURES', 'wayland', 'opengl', '', d)}"
+
+CVE_PRODUCT = "webkitgtk webkitgtk\+"
+
+DEPENDS += " \
+          ruby-native \
+          gperf-native \
+          unifdef-native \
+          cairo \
+          harfbuzz \
+          jpeg \
+          atk \
+          libwebp \
+          gtk+3 \
+          libxslt \
+          libtasn1 \
+          libnotify \
+          gstreamer1.0 \
+          gstreamer1.0-plugins-base \
+          glib-2.0-native \
+          gettext-native \
+          "
+
+PACKAGECONFIG_SOUP ?= "soup3"
+PACKAGECONFIG ??= "${@bb.utils.filter('DISTRO_FEATURES', 'systemd wayland x11', d)} \
+                   ${@bb.utils.contains('DISTRO_FEATURES', 'x11 opengl', 'webgl opengl', '', d)} \
+                   ${@bb.utils.contains('DISTRO_FEATURES', 'x11', '', 'webgl gles2', d)} \
+                   ${@bb.utils.contains('DISTRO_FEATURES', 'opengl', 'opengl-or-es', '', d)} \
+                   enchant \
+                   libsecret \
+                   ${PACKAGECONFIG_SOUP} \
+                  "
+
+PACKAGECONFIG[wayland] = "-DENABLE_WAYLAND_TARGET=ON,-DENABLE_WAYLAND_TARGET=OFF,wayland libwpe wpebackend-fdo wayland-native"
+PACKAGECONFIG[angle] = "-DUSE_ANGLE_WEBGL=ON,-DUSE_ANGLE_WEBGL=OFF"
+PACKAGECONFIG[x11] = "-DENABLE_X11_TARGET=ON,-DENABLE_X11_TARGET=OFF,virtual/libx11 libxcomposite libxdamage libxrender libxt"
+PACKAGECONFIG[geoclue] = "-DENABLE_GEOLOCATION=ON,-DENABLE_GEOLOCATION=OFF,geoclue"
+PACKAGECONFIG[enchant] = "-DENABLE_SPELLCHECK=ON,-DENABLE_SPELLCHECK=OFF,enchant2"
+PACKAGECONFIG[gles2] = "-DENABLE_GLES2=ON,-DENABLE_GLES2=OFF,virtual/libgles2"
+PACKAGECONFIG[jpegxl] = " -DUSE_JPEGXL=ON,-DUSE_JPEGXL=OFF,libjxl"
+PACKAGECONFIG[webgl] = "-DENABLE_WEBGL=ON,-DENABLE_WEBGL=OFF,virtual/egl"
+PACKAGECONFIG[opengl] = "-DENABLE_GRAPHICS_CONTEXT_GL=ON,-DENABLE_GRAPHICS_CONTEXT_GL=OFF,virtual/egl"
+PACKAGECONFIG[opengl-or-es] = "-DUSE_OPENGL_OR_ES=ON,-DUSE_OPENGL_OR_ES=OFF"
+PACKAGECONFIG[libsecret] = "-DUSE_LIBSECRET=ON,-DUSE_LIBSECRET=OFF,libsecret"
+PACKAGECONFIG[libhyphen] = "-DUSE_LIBHYPHEN=ON,-DUSE_LIBHYPHEN=OFF,libhyphen"
+PACKAGECONFIG[woff2] = "-DUSE_WOFF2=ON,-DUSE_WOFF2=OFF,woff2"
+PACKAGECONFIG[openjpeg] = "-DUSE_OPENJPEG=ON,-DUSE_OPENJPEG=OFF,openjpeg"
+PACKAGECONFIG[systemd] = "-DUSE_SYSTEMD=ON,-DUSE_SYSTEMD=off,systemd"
+PACKAGECONFIG[reduce-size] = "-DCMAKE_BUILD_TYPE=MinSizeRel,-DCMAKE_BUILD_TYPE=Release,,"
+PACKAGECONFIG[lcms] = "-DUSE_LCMS=ON,-DUSE_LCMS=OFF,lcms"
+PACKAGECONFIG[soup2] = "-DUSE_SOUP2=ON,-DUSE_SOUP2=OFF,libsoup-2.4,,,soup3"
+PACKAGECONFIG[soup3] = ",,libsoup,,,soup2"
+PACKAGECONFIG[journald] = "-DENABLE_JOURNALD_LOG=ON,-DENABLE_JOURNALD_LOG=OFF,systemd"
+PACKAGECONFIG[avif] = "-DUSE_AVIF_LOG=ON,-DUSE_AVIF=OFF,libavif"
+PACKAGECONFIG[media-recorder] = "-DENABLE_MEDIA_RECORDER=ON,-DENABLE_MEDIA_RECORDER=OFF,gstreamer1.0-plugins-bad"
+PACKAGECONFIG[gamepad] = "-DENABLE_GAMEPAD=ON,-DENABLE_GAMEPAD=OFF,libmanette"
+PACKAGECONFIG[webrtc] = "-DENABLE_WEB_RTC=ON,-DENABLE_WEB_RTC=OFF"
+PACKAGECONFIG[bubblewrap] = "-DENABLE_BUBBLEWRAP_SANDBOX=ON -DBWRAP_EXECUTABLE=${bindir}/bwrap -DDBUS_PROXY_EXECUTABLE=${bindir}/xdg-dbus-proxy,-DENABLE_BUBBLEWRAP_SANDBOX=OFF,,bubblewrap xdg-dbus-proxy"
+
+EXTRA_OECMAKE = " \
+		-DPORT=GTK \
+		${@bb.utils.contains('GI_DATA_ENABLED', 'True', '-DENABLE_INTROSPECTION=ON', '-DENABLE_INTROSPECTION=OFF', d)} \
+		${@bb.utils.contains('GIDOCGEN_ENABLED', 'True', '-DENABLE_DOCUMENTATION=ON', '-DENABLE_DOCUMENTATION=OFF', d)} \
+		-DENABLE_MINIBROWSER=ON \
+		"
+# Unless DEBUG_BUILD is enabled, pass -g1 to massively reduce the size of the
+# debug symbols (4.3GB to 700M at time of writing)
+DEBUG_FLAGS:append = "${@oe.utils.vartrue('DEBUG_BUILD', '', ' -g1', d)}"
+
+# Javascript JIT is not supported on ARC
+EXTRA_OECMAKE:append:arc = " -DENABLE_JIT=OFF "
+# By default 25-bit "medium" calls are used on ARC
+# which is not enough for binaries larger than 32 MiB
+CFLAGS:append:arc = " -mlong-calls"
+CXXFLAGS:append:arc = " -mlong-calls"
+
+# Needed for non-mesa graphics stacks when x11 is disabled
+CXXFLAGS += "${@bb.utils.contains('DISTRO_FEATURES', 'x11', '', '-DEGL_NO_X11=1', d)}"
+
+# Javascript JIT is not supported on powerpc
+EXTRA_OECMAKE:append:powerpc = " -DENABLE_JIT=OFF "
+EXTRA_OECMAKE:append:powerpc64 = " -DENABLE_JIT=OFF "
+
+# ARM JIT code does not build on ARMv4/5/6 anymore
+EXTRA_OECMAKE:append:armv4 = " -DENABLE_JIT=OFF "
+EXTRA_OECMAKE:append:armv5 = " -DENABLE_JIT=OFF "
+EXTRA_OECMAKE:append:armv6 = " -DENABLE_JIT=OFF "
+
+# And for armv7* don't enable it for softfp, because after:
+# https://github.com/WebKit/WebKit/commit/a2ec4ef1997d6fafa6ffc607bffb54e76168a918
+# https://bugs.webkit.org/show_bug.cgi?id=242172
+# softfp armv7* fails because WEBASSEMBLY is left enabled by default and JIT gets
+# explicitly disabled causing:
+# http://errors.yoctoproject.org/Errors/Details/734587/
+# PR was sent upstream, but the end result is the same both JIT and WEBASSEMBLY disabled
+# https://github.com/WebKit/WebKit/pull/17447
+EXTRA_OECMAKE:append:armv7a = " -DENABLE_JIT=${@bb.utils.contains('TUNE_FEATURES', 'callconvention-hard', 'ON', 'OFF', d)}"
+EXTRA_OECMAKE:append:armv7r = " -DENABLE_JIT=${@bb.utils.contains('TUNE_FEATURES', 'callconvention-hard', 'ON', 'OFF', d)}"
+EXTRA_OECMAKE:append:armv7ve = " -DENABLE_JIT=${@bb.utils.contains('TUNE_FEATURES', 'callconvention-hard', 'ON', 'OFF', d)}"
+
+EXTRA_OECMAKE:append:mipsarch = " -DUSE_LD_GOLD=OFF "
+EXTRA_OECMAKE:append:powerpc = " -DUSE_LD_GOLD=OFF "
+
+# JIT and gold linker does not work on RISCV
+EXTRA_OECMAKE:append:riscv32 = " -DUSE_LD_GOLD=OFF -DENABLE_JIT=OFF"
+EXTRA_OECMAKE:append:riscv64 = " -DUSE_LD_GOLD=OFF"
+
+# JIT not supported on MIPS either
+EXTRA_OECMAKE:append:mipsarch = " -DENABLE_JIT=OFF -DENABLE_C_LOOP=ON "
+
+# JIT not supported on X32
+# An attempt was made to upstream JIT support for x32 in
+# https://bugs.webkit.org/show_bug.cgi?id=100450, but this was closed as
+# unresolved due to limited X32 adoption.
+EXTRA_OECMAKE:append:x86-x32 = " -DENABLE_JIT=OFF "
+
+SECURITY_CFLAGS:remove:aarch64 = "-fpie"
+SECURITY_CFLAGS:append:aarch64 = " -fPIE"
+
+FILES:${PN} += "${libdir}/webkit2gtk-4.*/injected-bundle/libwebkit2gtkinjectedbundle.so"
+
+RRECOMMENDS:${PN} += "ca-certificates shared-mime-info"
+
+# http://errors.yoctoproject.org/Errors/Details/20370/
+ARM_INSTRUCTION_SET:armv4 = "arm"
+ARM_INSTRUCTION_SET:armv5 = "arm"
+ARM_INSTRUCTION_SET:armv6 = "arm"
+
+# https://bugzilla.yoctoproject.org/show_bug.cgi?id=9474
+# https://bugs.webkit.org/show_bug.cgi?id=159880
+# JSC JIT can build on ARMv7 with -marm, but doesn't work on runtime.
+# Upstream only tests regularly the JSC JIT on ARMv7 with Thumb2 (-mthumb).
+ARM_INSTRUCTION_SET:armv7a = "thumb"
+ARM_INSTRUCTION_SET:armv7r = "thumb"
+ARM_INSTRUCTION_SET:armv7ve = "thumb"
+
+# ANGLE requires SSE support as of webkit 2.40.x on 32 bit x86
+COMPATIBLE_HOST:x86 = "${@bb.utils.contains_any('TUNE_FEATURES', 'core2 corei7', '.*', 'null', d)}"
+
+# introspection inside qemu-arm hangs forever on musl/arm builds
+# therefore disable GI_DATA
+GI_DATA_ENABLED:libc-musl:armv7a = "False"
+GI_DATA_ENABLED:libc-musl:armv7ve = "False"
+
+do_install:append() {
+	mv ${D}${bindir}/WebKitWebDriver ${D}${bindir}/WebKitWebDriver3
+}
+
+PACKAGE_PREPROCESS_FUNCS += "src_package_preprocess"
+src_package_preprocess () {
+        # Trim build paths from comments in generated sources to ensure reproducibility
+        sed -i -e "s,${WORKDIR},,g" \
+            ${B}/JavaScriptCore/DerivedSources/*.h \
+            ${B}/JavaScriptCore/DerivedSources/yarr/*.h \
+            ${B}/JavaScriptCore/PrivateHeaders/JavaScriptCore/*.h \
+            ${B}/WebCore/DerivedSources/*.cpp \
+            ${B}/WebKitGTK/DerivedSources/webkit/*.cpp
+}
+