subtree updates: raspberrypi security arm

meta-arm: eb9c47a4e1..9b6c8c95e4:
  Abdellatif El Khlifi (1):
        CI: append classes to INHERIT in the common fvp.yml

  Adam Johnston (1):
        arm-bsp/linux-yocto: Update N1SDP PCI quirk patch

  Jon Mason (10):
        CI: add yml files for defaults
        CI: add support for dev kernel, rt kernel, and poky-tiny
        arm-bsp/fvp-base: update to u-boot 2023.01
        arm-bsp/fvp-base-arm32: remove support
        ci: add external-toolchain to qemuarm-secureboot
        arm-bsp/optee: remove unused recipes
        arm/optee: optee-os include cleanup
        arm/optee-os: update to 3.20.0
        arm/edk2: update version and relocate edk2-basetools to be with edk2
        arm-bsp/fvp-base: Add edk2 build testing

  Ross Burton (7):
        arm-bsp/linux-arm64-ack: update Upstream-Status tags
        CI: add CI_CLEAN_REPOS variable to allow cleaning the repo reference cache
        arm/scp-firmware: fix up whitespace
        arm/scp-firmware: enable verbose builds
        arm/scp-firmware: remove textrel from INSANE_SKIP
        arm/scp-firmware: improve debug packaging
        CI: mask poky's llvm if we're using clang

  Rui Miguel Silva (1):
        arm-bsp/optee: bump corstone1000 to v3.20

  Satish Kumar (1):
        arm-bsp/corstone1000: new gpt based disk layout and fwu metadata

  Xueliang Zhong (1):
        arm-bsp/n1sdp: update to linux yocto kernel 6.1

meta-security: c06b9a18a6..a397a38ed9:
  Armin Kuster (16):
        openscap: update to 1.3.6
        openscap: update to 1.3.7
        openscap git: add DEFAULT_PREFERENCE
        python3-fail2ban: update to 1.0.2
        python3-privacyidea: update to 3.8.1
        libhtp: update to 0.5.42
        lkrg-modules: update to 0.9.6
        chkrootkit: update to 0.57
        fscrypt: update to 1.1.0
        libmspack: update to 1.11
        firejail: update 0.9.72
        suricata: update to 6.0.10
        apparmor: update to 3.1.3
        krill: update 0.12.3
        cryptmout: update to 6.2.0
        packagegroup-core-security: refactor the inclusion of krill

  Eero Aaltonen (1):
        dm-verity-img.bbclass: fix syntax warning

  Jose Quaresma (3):
        meta-hardening/layer: lower the priority from 10 to 6
        meta-security-compliance/layer: lower the priority from 10 to 6
        meta-tpm/layer: lower the priority from 10 to 6

  Kevin Hao (1):
        dm-verity-img.bbclass: Fix the hash offset alignment issue

  Mikko Rapeli (1):
        ima-evm-utils: disable documentation from build

  Paul Gortmaker (3):
        dm-verity: update beaglebone wic to match meta-yocto
        dm-verity: add basic non-arch/non-BSP yocto specific settings
        dm-verity: document board specifics for Beaglebone Black

  Peter Marko (1):
        tpm2-tss: correct CVE product

meta-raspberrypi: e15b876155..3afdbbf782:
  Carlos Alberto Lopez Perez (1):
        mesa-demos: enable build with userland graphics drivers.

  Khem Raj (6):
        linux-raspberrypi: Add recipes for 6.1 kernel
        psplash: Make psplash wait for the framebuffer to be ready
        rpi-default-versions: Use 6.1 kernel as default
        gstreamer1.0-plugins-bad: Drop gpl packageconfig
        rpidistro-ffmpeg: Pin to use gcc always
        rpidistro-vlc: Fix build with clang16

Signed-off-by: Andrew Geissler <geissonator@yahoo.com>
Change-Id: Ie6e60085306d31972098b87738eb550e5140b92a

8 files changed, 163 insertions, 125 deletions

diff --git a/meta-security/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch b/meta-security/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch
index a32720a9e3..7e70692275 100644
--- a/meta-security/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch
+++ b/meta-security/recipes-security/Firejail/firejail/exclude_seccomp_util_compiles.patch
@@ -5,28 +5,28 @@ There are some files that need to run to generate the appropriate files
 we are currently doing this on the target. 
 Signed-off-by: Armin Kuster <akuster808@gmail.com>
 
-Index: git/Makefile.in
+Index: git/Makefile
 ===================================================================
---- git.orig/Makefile.in
-+++ git/Makefile.in
-@@ -34,7 +34,6 @@ MYDIRS = src/lib $(MAN_SRC) $(COMPLETION
+--- git.orig/Makefile
++++ git/Makefile
+@@ -18,7 +18,6 @@ MYDIRS = src/lib $(MAN_SRC) $(COMPLETION
  MYLIBS = src/libpostexecseccomp/libpostexecseccomp.so src/libtrace/libtrace.so src/libtracelog/libtracelog.so
  COMPLETIONS = src/zsh_completion/_firejail src/bash_completion/firejail.bash_completion
  MANPAGES = firejail.1 firemon.1 firecfg.1 firejail-profile.5 firejail-login.5 firejail-users.5 jailcheck.1
 -SECCOMP_FILTERS = seccomp seccomp.debug seccomp.32 seccomp.block_secondary seccomp.mdwx seccomp.mdwx.32
  ALL_ITEMS = $(APPS) $(SBOX_APPS) $(SBOX_APPS_NON_DUMPABLE) $(MYLIBS)
  
- .PHONY: all_items $(ALL_ITEMS)
-@@ -52,7 +51,7 @@ $(MANPAGES): src/man
+ .PHONY: all
+@@ -43,7 +42,7 @@ $(MANPAGES): src/man config.mk
  
  man: $(MANPAGES)
  
 -filters: $(SECCOMP_FILTERS) $(SBOX_APPS_NON_DUMPABLE)
-+filters: $(SBOX_APPS_NON_DUMPABLE)
++filters:  $(SBOX_APPS_NON_DUMPABLE)
  seccomp: src/fseccomp/fseccomp src/fsec-optimize/fsec-optimize
  	src/fseccomp/fseccomp default seccomp
  	src/fsec-optimize/fsec-optimize seccomp
-@@ -81,7 +80,6 @@ clean:
+@@ -72,7 +71,6 @@ clean:
  	done
  	$(MAKE) -C test clean
  	rm -f $(MANPAGES) $(MANPAGES:%=%.gz) firejail*.rpm
@@ -34,12 +34,12 @@ Index: git/Makefile.in
  	rm -f test/utils/index.html*
  	rm -f test/utils/wget-log
  	rm -f test/utils/firejail-test-file*
-@@ -119,7 +117,7 @@ endif
+@@ -110,7 +108,7 @@ endif
  	# libraries and plugins
  	install -m 0755 -d $(DESTDIR)$(libdir)/firejail
  	install -m 0755 -t $(DESTDIR)$(libdir)/firejail src/firecfg/firejail-welcome.sh
 -	install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) $(SECCOMP_FILTERS)
-+	install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS) 
++	install -m 0644 -t $(DESTDIR)$(libdir)/firejail $(MYLIBS)
  	install -m 0755 -t $(DESTDIR)$(libdir)/firejail $(SBOX_APPS)
  	install -m 0755 -t $(DESTDIR)$(libdir)/firejail src/profstats/profstats
  	# plugins w/o read permission (non-dumpable)
diff --git a/meta-security/recipes-security/Firejail/firejail_0.9.70.bb b/meta-security/recipes-security/Firejail/firejail_0.9.72.bb
index 35f7b076c7..12a3105c68 100644
--- a/meta-security/recipes-security/Firejail/firejail_0.9.70.bb
+++ b/meta-security/recipes-security/Firejail/firejail_0.9.72.bb
@@ -9,7 +9,7 @@ seccomp-bpf and Linux capabilities."
 LIC_FILES_CHKSUM = "file://COPYING;md5=b234ee4d69f5fce4486a80fdaf4a4263"
 LICENSE = "GPL-2.0-only"
 
-SRCREV = "b4b08d21cd95725c9d55dfdb6987fcc6d7893247"
+SRCREV = "2551bc71f14052344666f3ca2ad67f5b798020b9"
 SRC_URI = "git://github.com/netblue30/firejail.git;protocol=https;branch=master \
            file://exclude_seccomp_util_compiles.patch \
            "
@@ -46,6 +46,7 @@ PACKAGES:append = " ${PN}-vim ${PN}-zsh"
 
 FILES:${PN}-vim = "${datadir}/vim/"
 FILES:${PN}-zsh = "${datadir}/zsh/"
+FILES:${PN}-dev = "${datadir}/gtksourceview-5/"
 
 pkg_postinst_ontarget:${PN} () {
     ${libdir}/${BPN}/fseccomp default ${libdir}/${BPN}/seccomp
diff --git a/meta-security/recipes-security/cryptmount/cryptmount_6.0.bb b/meta-security/recipes-security/cryptmount/cryptmount_6.2.0.bb
index d712a615a3..d815e1d7b2 100644
--- a/meta-security/recipes-security/cryptmount/cryptmount_6.0.bb
+++ b/meta-security/recipes-security/cryptmount/cryptmount_6.2.0.bb
@@ -1,12 +1,10 @@
 SUMMARY = "Linux encrypted filesystem management tool"
 HOMEPAGE = "http://cryptmount.sourceforge.net/"
-LIC_FILES_CHKSUM = "file://README;beginline=3;endline=4;md5=dae0772f0ff46fd927e7fdb08af51b71"
+LIC_FILES_CHKSUM = "file://COPYING;beginline=1;endline=4;md5=6e69c425bf32ecf9b1e11d29d146d03d"
 LICENSE = "GPL-2.0-only"
+SRC_URI = "https://sourceforge.net/projects/cryptmount/files/${BPN}/${BPN}-6.2/${BPN}-${PV}.tar.gz"
 
-SRC_URI = "https://sourceforge.net/projects/cryptmount/files/${BPN}/${BPN}-${PV}/${BPN}-${PV}.tar.gz \
-           "
-
-SRC_URI[sha256sum] = "86528a9175e1eb53f60613e3c3ea6ae6d69dbfe5ac2b53b2f58ba0f768371e7e"
+SRC_URI[sha256sum] = "90cc49fd598d636929c70479b1305f12b011edadf4a54578ace6c0fca8cb5ed2"
 
 inherit autotools-brokensep gettext pkgconfig systemd
 
diff --git a/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb b/meta-security/recipes-security/fscrypt/fscrypt_1.1.0.bb
index 8147fe6e86..ea9593ba6c 100644
--- a/meta-security/recipes-security/fscrypt/fscrypt_1.0.0.bb
+++ b/meta-security/recipes-security/fscrypt/fscrypt_1.1.0.bb
@@ -11,7 +11,7 @@ LIC_FILES_CHKSUM = "file://src/${GO_IMPORT}/LICENSE;md5=3b83ef96387f14655fc854dd
 # fscrypt depends on go and libpam
 DEPENDS += "go-native libpam"
 
-SRCREV = "92b1e9a8670ccd3916a7d24a06cab1e4c9815bc4"
+SRCREV = "7c80c73c084ce9ea49a03b814dac7a82fd7b4c23"
 SRC_URI = "git://github.com/google/fscrypt.git;branch=master;protocol=https"
 
 GO_IMPORT = "import"
diff --git a/meta-security/recipes-security/krill/files/panic_workaround.patch b/meta-security/recipes-security/krill/files/panic_workaround.patch
index 9b08cb5ce9..dc26416a3d 100644
--- a/meta-security/recipes-security/krill/files/panic_workaround.patch
+++ b/meta-security/recipes-security/krill/files/panic_workaround.patch
@@ -5,7 +5,7 @@ Index: git/Cargo.toml
 ===================================================================
 --- git.orig/Cargo.toml
 +++ git/Cargo.toml
-@@ -71,7 +71,7 @@ static-openssl = [ "openssl/vendored" ]
+@@ -91,7 +91,7 @@ hsm-tests-pkcs11 = [ "hsm" ]
  # Make sure that Krill crashes on panics, rather than losing threads and
  # limping on in a bad state.
  [profile.release]
@@ -13,4 +13,4 @@ Index: git/Cargo.toml
 +#panic = "abort"
  
  [dev-dependencies]
- # for user management
+ regex     = "1.5.5"
diff --git a/meta-security/recipes-security/krill/krill.inc b/meta-security/recipes-security/krill/krill.inc
index bb40f57d2d..22fe26931a 100644
--- a/meta-security/recipes-security/krill/krill.inc
+++ b/meta-security/recipes-security/krill/krill.inc
@@ -1,3 +1,6 @@
+# Auto-Generated by cargo-bitbake 0.3.16
+#
+
 # please note if you have entries that do not begin with crate://
 # you must change them to how that package can be fetched
 SRC_URI += " \
@@ -5,46 +8,61 @@ SRC_URI += " \
     crate://crates.io/adler/1.0.2 \
     crate://crates.io/adler32/1.2.0 \
     crate://crates.io/aho-corasick/0.7.18 \
+    crate://crates.io/android_system_properties/0.1.5 \
     crate://crates.io/ansi_term/0.12.1 \
     crate://crates.io/ascii-canvas/3.0.0 \
     crate://crates.io/ascii/1.0.0 \
     crate://crates.io/atty/0.2.14 \
     crate://crates.io/autocfg/1.1.0 \
-    crate://crates.io/backtrace/0.3.64 \
+    crate://crates.io/backoff/0.3.0 \
+    crate://crates.io/backtrace/0.3.66 \
     crate://crates.io/base64/0.13.0 \
     crate://crates.io/basic-cookies/0.1.4 \
-    crate://crates.io/bcder/0.6.1 \
+    crate://crates.io/bcder/0.7.0 \
     crate://crates.io/bit-set/0.5.2 \
     crate://crates.io/bit-vec/0.6.3 \
     crate://crates.io/bitflags/1.3.2 \
+    crate://crates.io/block-buffer/0.10.2 \
     crate://crates.io/block-buffer/0.9.0 \
-    crate://crates.io/bumpalo/3.9.1 \
+    crate://crates.io/bumpalo/3.10.0 \
     crate://crates.io/bytes/1.1.0 \
     crate://crates.io/cc/1.0.73 \
     crate://crates.io/cfg-if/1.0.0 \
-    crate://crates.io/chrono/0.4.19 \
+    crate://crates.io/chrono/0.4.22 \
     crate://crates.io/chunked_transfer/1.4.0 \
     crate://crates.io/cipher/0.2.5 \
     crate://crates.io/clap/2.34.0 \
+    crate://crates.io/codespan-reporting/0.11.1 \
     crate://crates.io/core-foundation-sys/0.8.3 \
     crate://crates.io/core-foundation/0.9.3 \
-    crate://crates.io/cpufeatures/0.2.1 \
+    crate://crates.io/cpufeatures/0.2.2 \
     crate://crates.io/crc32fast/1.3.2 \
     crate://crates.io/crunchy/0.2.2 \
+    crate://crates.io/crypto-common/0.1.6 \
     crate://crates.io/crypto-mac/0.10.1 \
-    crate://crates.io/ctrlc/3.2.1 \
+    crate://crates.io/cryptoki-sys/0.1.4 \
+    crate://crates.io/cryptoki/0.3.0 \
+    crate://crates.io/ctrlc/3.2.2 \
+    crate://crates.io/cxx-build/1.0.79 \
+    crate://crates.io/cxx/1.0.79 \
+    crate://crates.io/cxxbridge-flags/1.0.79 \
+    crate://crates.io/cxxbridge-macro/1.0.79 \
+    crate://crates.io/derivative/2.2.0 \
     crate://crates.io/deunicode/0.4.3 \
-    crate://crates.io/diff/0.1.12 \
+    crate://crates.io/diff/0.1.13 \
+    crate://crates.io/digest/0.10.3 \
     crate://crates.io/digest/0.9.0 \
     crate://crates.io/dirs-next/2.0.0 \
     crate://crates.io/dirs-sys-next/0.1.2 \
-    crate://crates.io/either/1.6.1 \
+    crate://crates.io/either/1.7.0 \
     crate://crates.io/ena/0.14.0 \
-    crate://crates.io/encoding_rs/0.8.30 \
+    crate://crates.io/encoding_rs/0.8.31 \
+    crate://crates.io/enum-display-derive/0.1.1 \
+    crate://crates.io/enum-flags/0.1.8 \
     crate://crates.io/error-chain/0.11.0 \
     crate://crates.io/fastrand/1.7.0 \
     crate://crates.io/fern/0.5.9 \
-    crate://crates.io/fixedbitset/0.2.0 \
+    crate://crates.io/fixedbitset/0.4.2 \
     crate://crates.io/fnv/1.0.7 \
     crate://crates.io/foreign-types-shared/0.1.1 \
     crate://crates.io/foreign-types/0.3.2 \
@@ -60,181 +78,202 @@ SRC_URI += " \
     crate://crates.io/futures-util/0.3.21 \
     crate://crates.io/futures/0.3.21 \
     crate://crates.io/generic-array/0.14.5 \
-    crate://crates.io/getrandom/0.2.4 \
-    crate://crates.io/gimli/0.26.1 \
-    crate://crates.io/h2/0.3.11 \
-    crate://crates.io/hashbrown/0.11.2 \
+    crate://crates.io/getrandom/0.2.7 \
+    crate://crates.io/gimli/0.26.2 \
+    crate://crates.io/h2/0.3.13 \
+    crate://crates.io/hashbrown/0.12.3 \
     crate://crates.io/hermit-abi/0.1.19 \
     crate://crates.io/hex/0.4.3 \
     crate://crates.io/hmac/0.10.1 \
-    crate://crates.io/http-body/0.4.4 \
-    crate://crates.io/http/0.2.6 \
-    crate://crates.io/httparse/1.6.0 \
+    crate://crates.io/http-body/0.4.5 \
+    crate://crates.io/http/0.2.8 \
+    crate://crates.io/httparse/1.7.1 \
     crate://crates.io/httpdate/1.0.2 \
     crate://crates.io/hyper-tls/0.5.0 \
-    crate://crates.io/hyper/0.14.17 \
+    crate://crates.io/hyper/0.14.20 \
+    crate://crates.io/iana-time-zone-haiku/0.1.1 \
+    crate://crates.io/iana-time-zone/0.1.51 \
     crate://crates.io/idna/0.2.3 \
     crate://crates.io/impl-trait-for-tuples/0.2.2 \
-    crate://crates.io/indexmap/1.8.0 \
+    crate://crates.io/indexmap/1.9.1 \
     crate://crates.io/instant/0.1.12 \
     crate://crates.io/intervaltree/0.2.7 \
-    crate://crates.io/ipnet/2.3.1 \
+    crate://crates.io/ipnet/2.5.0 \
     crate://crates.io/itertools/0.10.3 \
-    crate://crates.io/itertools/0.9.0 \
-    crate://crates.io/itoa/1.0.1 \
+    crate://crates.io/itoa/1.0.2 \
     crate://crates.io/jmespatch/0.3.0 \
-    crate://crates.io/js-sys/0.3.56 \
-    crate://crates.io/lalrpop-util/0.19.7 \
-    crate://crates.io/lalrpop/0.19.7 \
+    crate://crates.io/js-sys/0.3.58 \
+    crate://crates.io/kmip-protocol/0.4.2 \
+    crate://crates.io/kmip-ttlv/0.3.3 \
+    crate://crates.io/lalrpop-util/0.19.8 \
+    crate://crates.io/lalrpop/0.19.8 \
     crate://crates.io/lazy_static/1.4.0 \
-    crate://crates.io/libc/0.2.119 \
-    crate://crates.io/libflate/1.1.2 \
+    crate://crates.io/libc/0.2.126 \
+    crate://crates.io/libflate/1.2.0 \
     crate://crates.io/libflate_lz77/1.1.0 \
-    crate://crates.io/lock_api/0.4.6 \
-    crate://crates.io/log/0.4.14 \
+    crate://crates.io/libloading/0.7.3 \
+    crate://crates.io/link-cplusplus/1.0.7 \
+    crate://crates.io/lock_api/0.4.7 \
+    crate://crates.io/log/0.4.17 \
     crate://crates.io/maplit/1.0.2 \
     crate://crates.io/matchers/0.0.1 \
     crate://crates.io/matches/0.1.9 \
-    crate://crates.io/memchr/2.4.1 \
-    crate://crates.io/memoffset/0.6.5 \
+    crate://crates.io/maybe-async/0.2.6 \
+    crate://crates.io/memchr/2.5.0 \
     crate://crates.io/mime/0.3.16 \
-    crate://crates.io/miniz_oxide/0.4.4 \
-    crate://crates.io/mio/0.8.0 \
-    crate://crates.io/miow/0.3.7 \
-    crate://crates.io/native-tls/0.2.8 \
+    crate://crates.io/miniz_oxide/0.5.3 \
+    crate://crates.io/mio/0.8.4 \
+    crate://crates.io/native-tls/0.2.10 \
     crate://crates.io/new_debug_unreachable/1.0.4 \
-    crate://crates.io/nix/0.23.1 \
-    crate://crates.io/ntapi/0.3.7 \
+    crate://crates.io/nix/0.24.2 \
     crate://crates.io/num-bigint/0.4.3 \
-    crate://crates.io/num-integer/0.1.44 \
-    crate://crates.io/num-traits/0.2.14 \
+    crate://crates.io/num-integer/0.1.45 \
+    crate://crates.io/num-traits/0.2.15 \
     crate://crates.io/num_cpus/1.13.1 \
-    crate://crates.io/oauth2/4.1.0 \
-    crate://crates.io/object/0.27.1 \
-    crate://crates.io/once_cell/1.9.0 \
+    crate://crates.io/oauth2/4.2.3 \
+    crate://crates.io/object/0.29.0 \
+    crate://crates.io/once_cell/1.13.0 \
     crate://crates.io/opaque-debug/0.3.0 \
-    crate://crates.io/openidconnect/2.2.0 \
+    crate://crates.io/openidconnect/2.3.2 \
+    crate://crates.io/openssl-macros/0.1.0 \
     crate://crates.io/openssl-probe/0.1.5 \
-    crate://crates.io/openssl-src/111.17.0+1.1.1m \
-    crate://crates.io/openssl-sys/0.9.72 \
-    crate://crates.io/openssl/0.10.38 \
-    crate://crates.io/ordered-float/1.1.1 \
+    crate://crates.io/openssl-src/111.25.0+1.1.1t \
+    crate://crates.io/openssl-sys/0.9.75 \
+    crate://crates.io/openssl/0.10.41 \
+    crate://crates.io/ordered-float/2.10.0 \
     crate://crates.io/oso/0.12.4 \
-    crate://crates.io/parking_lot/0.11.2 \
-    crate://crates.io/parking_lot_core/0.8.5 \
+    crate://crates.io/parking_lot/0.12.1 \
+    crate://crates.io/parking_lot_core/0.9.3 \
     crate://crates.io/pbkdf2/0.7.5 \
     crate://crates.io/percent-encoding/2.1.0 \
-    crate://crates.io/petgraph/0.5.1 \
+    crate://crates.io/petgraph/0.6.2 \
     crate://crates.io/phf_shared/0.10.0 \
     crate://crates.io/pico-args/0.4.2 \
-    crate://crates.io/pin-project-lite/0.2.8 \
+    crate://crates.io/pin-project-lite/0.2.9 \
     crate://crates.io/pin-utils/0.1.0 \
-    crate://crates.io/pkg-config/0.3.24 \
+    crate://crates.io/pkg-config/0.3.25 \
     crate://crates.io/polar-core/0.12.4 \
     crate://crates.io/ppv-lite86/0.2.16 \
     crate://crates.io/precomputed-hash/0.1.1 \
-    crate://crates.io/priority-queue/1.2.1 \
-    crate://crates.io/proc-macro2/1.0.36 \
-    crate://crates.io/quick-xml/0.22.0 \
-    crate://crates.io/quote/1.0.15 \
+    crate://crates.io/priority-queue/1.2.2 \
+    crate://crates.io/proc-macro2/1.0.40 \
+    crate://crates.io/quick-xml/0.23.0 \
+    crate://crates.io/quote/1.0.20 \
+    crate://crates.io/r2d2/0.8.10 \
     crate://crates.io/rand/0.8.5 \
     crate://crates.io/rand_chacha/0.3.1 \
     crate://crates.io/rand_core/0.6.3 \
-    crate://crates.io/redox_syscall/0.2.10 \
-    crate://crates.io/redox_users/0.4.0 \
+    crate://crates.io/redox_syscall/0.2.13 \
+    crate://crates.io/redox_users/0.4.3 \
     crate://crates.io/regex-automata/0.1.10 \
-    crate://crates.io/regex-syntax/0.6.25 \
-    crate://crates.io/regex/1.5.5 \
+    crate://crates.io/regex-syntax/0.6.27 \
+    crate://crates.io/regex/1.6.0 \
     crate://crates.io/remove_dir_all/0.5.3 \
-    crate://crates.io/reqwest/0.11.9 \
+    crate://crates.io/reqwest/0.11.11 \
     crate://crates.io/ring/0.16.20 \
     crate://crates.io/rle-decode-fast/1.0.3 \
+    crate://crates.io/routecore/0.2.0 \
     crate://crates.io/rpassword/5.0.1 \
-    crate://crates.io/rpki/0.13.2 \
+    crate://crates.io/rpki/0.15.8 \
     crate://crates.io/rustc-demangle/0.1.21 \
-    crate://crates.io/rustc_version/0.2.3 \
+    crate://crates.io/rustc_version/0.4.0 \
     crate://crates.io/rustls/0.19.1 \
-    crate://crates.io/rustversion/1.0.6 \
-    crate://crates.io/ryu/1.0.9 \
+    crate://crates.io/rustversion/1.0.8 \
+    crate://crates.io/ryu/1.0.10 \
     crate://crates.io/salsa20/0.7.2 \
-    crate://crates.io/schannel/0.1.19 \
+    crate://crates.io/schannel/0.1.20 \
+    crate://crates.io/scheduled-thread-pool/0.2.6 \
     crate://crates.io/scopeguard/1.1.0 \
+    crate://crates.io/scratch/1.0.2 \
     crate://crates.io/scrypt/0.6.5 \
     crate://crates.io/sct/0.6.1 \
     crate://crates.io/security-framework-sys/2.6.1 \
     crate://crates.io/security-framework/2.6.1 \
-    crate://crates.io/semver-parser/0.7.0 \
-    crate://crates.io/semver/0.9.0 \
-    crate://crates.io/serde-value/0.6.0 \
-    crate://crates.io/serde/1.0.136 \
-    crate://crates.io/serde_derive/1.0.136 \
-    crate://crates.io/serde_json/1.0.79 \
+    crate://crates.io/semver/1.0.12 \
+    crate://crates.io/serde-value/0.7.0 \
+    crate://crates.io/serde/1.0.139 \
+    crate://crates.io/serde_bytes/0.11.6 \
+    crate://crates.io/serde_derive/1.0.139 \
+    crate://crates.io/serde_json/1.0.82 \
     crate://crates.io/serde_path_to_error/0.1.7 \
     crate://crates.io/serde_urlencoded/0.7.1 \
+    crate://crates.io/sha2/0.10.2 \
     crate://crates.io/sha2/0.9.9 \
     crate://crates.io/sharded-slab/0.1.4 \
-    crate://crates.io/siphasher/0.3.9 \
-    crate://crates.io/slab/0.4.5 \
+    crate://crates.io/signal-hook-registry/1.4.0 \
+    crate://crates.io/siphasher/0.3.10 \
+    crate://crates.io/slab/0.4.6 \
     crate://crates.io/slug/0.1.4 \
-    crate://crates.io/smallvec/1.8.0 \
+    crate://crates.io/smallvec/1.9.0 \
     crate://crates.io/socket2/0.4.4 \
     crate://crates.io/spin/0.5.2 \
-    crate://crates.io/string_cache/0.8.3 \
+    crate://crates.io/string_cache/0.8.4 \
     crate://crates.io/strsim/0.8.0 \
     crate://crates.io/subtle/2.4.1 \
-    crate://crates.io/syn/1.0.86 \
+    crate://crates.io/syn/1.0.98 \
     crate://crates.io/syslog/4.0.1 \
+    crate://crates.io/target-lexicon/0.12.4 \
     crate://crates.io/tempfile/3.3.0 \
     crate://crates.io/term/0.7.0 \
+    crate://crates.io/termcolor/1.1.3 \
     crate://crates.io/textwrap/0.11.0 \
-    crate://crates.io/thiserror-impl/1.0.30 \
-    crate://crates.io/thiserror/1.0.30 \
+    crate://crates.io/thiserror-impl/1.0.31 \
+    crate://crates.io/thiserror/1.0.31 \
     crate://crates.io/thread_local/1.1.4 \
-    crate://crates.io/time/0.1.43 \
+    crate://crates.io/time/0.1.44 \
     crate://crates.io/tiny-keccak/2.0.2 \
     crate://crates.io/tiny_http/0.8.2 \
-    crate://crates.io/tinyvec/1.5.1 \
+    crate://crates.io/tinyvec/1.6.0 \
     crate://crates.io/tinyvec_macros/0.1.0 \
-    crate://crates.io/tokio-macros/1.7.0 \
+    crate://crates.io/tokio-macros/1.8.0 \
     crate://crates.io/tokio-native-tls/0.3.0 \
     crate://crates.io/tokio-rustls/0.22.0 \
-    crate://crates.io/tokio-util/0.6.9 \
-    crate://crates.io/tokio/1.17.0 \
-    crate://crates.io/toml/0.5.8 \
-    crate://crates.io/tower-service/0.3.1 \
-    crate://crates.io/tracing-attributes/0.1.19 \
-    crate://crates.io/tracing-core/0.1.22 \
-    crate://crates.io/tracing-log/0.1.2 \
+    crate://crates.io/tokio-util/0.7.3 \
+    crate://crates.io/tokio/1.20.4 \
+    crate://crates.io/toml/0.5.9 \
+    crate://crates.io/tower-service/0.3.2 \
+    crate://crates.io/tracing-attributes/0.1.22 \
+    crate://crates.io/tracing-core/0.1.28 \
+    crate://crates.io/tracing-log/0.1.3 \
     crate://crates.io/tracing-serde/0.1.3 \
     crate://crates.io/tracing-subscriber/0.2.25 \
-    crate://crates.io/tracing/0.1.31 \
+    crate://crates.io/tracing/0.1.35 \
+    crate://crates.io/trait-set/0.2.0 \
     crate://crates.io/try-lock/0.2.3 \
     crate://crates.io/typenum/1.15.0 \
-    crate://crates.io/unicode-bidi/0.3.7 \
-    crate://crates.io/unicode-normalization/0.1.19 \
+    crate://crates.io/unicode-bidi/0.3.8 \
+    crate://crates.io/unicode-ident/1.0.2 \
+    crate://crates.io/unicode-normalization/0.1.21 \
     crate://crates.io/unicode-width/0.1.9 \
-    crate://crates.io/unicode-xid/0.2.2 \
+    crate://crates.io/unicode-xid/0.2.3 \
     crate://crates.io/untrusted/0.7.1 \
     crate://crates.io/url/2.2.2 \
     crate://crates.io/urlparse/0.7.3 \
-    crate://crates.io/uuid/0.8.2 \
+    crate://crates.io/uuid/1.1.2 \
     crate://crates.io/valuable/0.1.0 \
     crate://crates.io/vcpkg/0.2.15 \
     crate://crates.io/vec_map/0.8.2 \
     crate://crates.io/version_check/0.9.4 \
     crate://crates.io/want/0.3.0 \
-    crate://crates.io/wasi/0.10.2+wasi-snapshot-preview1 \
-    crate://crates.io/wasm-bindgen-backend/0.2.79 \
-    crate://crates.io/wasm-bindgen-futures/0.4.29 \
-    crate://crates.io/wasm-bindgen-macro-support/0.2.79 \
-    crate://crates.io/wasm-bindgen-macro/0.2.79 \
-    crate://crates.io/wasm-bindgen-shared/0.2.79 \
-    crate://crates.io/wasm-bindgen/0.2.79 \
-    crate://crates.io/web-sys/0.3.56 \
+    crate://crates.io/wasi/0.10.0+wasi-snapshot-preview1 \
+    crate://crates.io/wasi/0.11.0+wasi-snapshot-preview1 \
+    crate://crates.io/wasm-bindgen-backend/0.2.81 \
+    crate://crates.io/wasm-bindgen-futures/0.4.31 \
+    crate://crates.io/wasm-bindgen-macro-support/0.2.81 \
+    crate://crates.io/wasm-bindgen-macro/0.2.81 \
+    crate://crates.io/wasm-bindgen-shared/0.2.81 \
+    crate://crates.io/wasm-bindgen/0.2.81 \
+    crate://crates.io/web-sys/0.3.58 \
     crate://crates.io/webpki/0.21.4 \
     crate://crates.io/winapi-i686-pc-windows-gnu/0.4.0 \
+    crate://crates.io/winapi-util/0.1.5 \
     crate://crates.io/winapi-x86_64-pc-windows-gnu/0.4.0 \
     crate://crates.io/winapi/0.3.9 \
-    crate://crates.io/winreg/0.7.0 \
-    crate://crates.io/xml-rs/0.8.4 \
+    crate://crates.io/windows-sys/0.36.1 \
+    crate://crates.io/windows_aarch64_msvc/0.36.1 \
+    crate://crates.io/windows_i686_gnu/0.36.1 \
+    crate://crates.io/windows_i686_msvc/0.36.1 \
+    crate://crates.io/windows_x86_64_gnu/0.36.1 \
+    crate://crates.io/windows_x86_64_msvc/0.36.1 \
+    crate://crates.io/winreg/0.10.1 \
 "
diff --git a/meta-security/recipes-security/krill/krill_0.9.6.bb b/meta-security/recipes-security/krill/krill_0.12.3.bb
index fd86c4bbb4..a943c52471 100644
--- a/meta-security/recipes-security/krill/krill_0.9.6.bb
+++ b/meta-security/recipes-security/krill/krill_0.12.3.bb
@@ -7,7 +7,7 @@ DEPENDS = "openssl"
 
 # SRC_URI += "crate://crates.io/krill/0.9.1"
 SRC_URI = "git://github.com/NLnetLabs/krill.git;protocol=https;branch=main"
-SRCREV = "95e6681d5b4024cac7a1892d47fb76abc68f34fb"
+SRCREV = "e92098419c7ad82939e0483bc76df21eff705b80"
 SRC_URI += "file://panic_workaround.patch"
 
 include krill.inc
diff --git a/meta-security/recipes-security/libmspack/libmspack_1.9.1.bb b/meta-security/recipes-security/libmspack/libmspack_1.11.bb
index 1b91f46b6c..59df84b73e 100644
--- a/meta-security/recipes-security/libmspack/libmspack_1.9.1.bb
+++ b/meta-security/recipes-security/libmspack/libmspack_1.11.bb
@@ -6,7 +6,7 @@ DEPENDS = ""
 
 LIC_FILES_CHKSUM = "file://COPYING.LIB;beginline=1;endline=2;md5=5b1fd1f66ef926b3c8a5bb00a72a28dd"
 
-SRCREV = "63d3faf90423a4a6c174539a7d32111a840adadc"
+SRCREV = "305907723a4e7ab2018e58040059ffb5e77db837"
 SRC_URI = "git://github.com/kyz/libmspack.git;branch=master;protocol=https"
 
 inherit autotools