subtree updates2.12.0-rc1

meta-openembedded: 5357c7a40e..a47ef04661:
  Adrian Fiergolski (1):
        python3-matplotlib: add missing dependency

  Adrian Freihofer (2):
        conntrack-tools: fix postinst script
        modemmanager: update to 1.18.8

  Akash Hadke (2):
        ntfs-3g-ntfsprogs: Set CVE_PRODUCT to "tuxera:ntfs-3g"
        iperf: Set CVE_PRODUCT to "iperf_project:iperf"

  Armin Kuster (5):
        meta-oe-image: fix build depends
        meta-python-image: Fix build depends
        meta-gnome: fix layer depends.
        mariadb: update to 10.7.4
        mariadb: Fix i386 Clang builds

  Ashish Sharma (1):
        netserver: don't change permissions on /dev/null

  Aurélien Bertron (1):
        fix(syslog-ng): warning about conf version

  Bartosz Golaszewski (2):
        python3-speedtest-cli: fix RDEPENDS
        python3-pybluez: fix a runtime issue with python 3.10

  Bassem Boubaker (1):
        conntrack-tools: Fix missing capability

  Changqing Li (5):
        chrony: create /var/lib/chrony by systemd-tmpfiles
        redis: upgrade 6.2.6 -> 6.2.7
        redis: upgrade 7.0-rc3 -> 7.0.2
        apache2: upgrade 2.4.53 -> 2.4.54
        zabbix: upgrade 5.2.6 -> 5.4.12

  Chen Qi (1):
        ntfs-3g-ntfsprogs: upgrade to 2022.5.17

  Davide Gardenal (11):
        emlog: ignore unrelated CVEs
        imagemagick: upgrade 7.0.10-25 -> 7.0.10-62
        usrsctp: add CVE_VERSION to correctly check for CVEs
        openflow: ignore CVE-2018-1078
        ntp: ignore many CVEs
        wireshark: upgrade 3.4.11 -> 3.4.12
        thrift: add CVE_PRODUCT to fix CVE reporting
        spice: ignore patched CVEs
        quagga: ignore CVE-2016-4049
        freeradius: ignore patched CVEs
        openflow: ignore unrelated CVEs

  Denys Dmytriyenko (3):
        devmem2: reinstate previous patches, removed by mistake
        devmem2: add support for different page sizes
        devmem2: the source and patches moved to github repo

  Diego Sueiro (1):
        bats: upgrade 1.6.0 -> 1.6.1

  Gianfranco (2):
        sdbus-c++-libsystemd: Bump SRCREV to last commit of 250-stable branch
        libmtp: Add doxygen-native dependency in case documentation build is enabled in PACKAGECONFIG. This fixes a FTBFS due to missing dependency.

  Gianfranco Costamagna (1):
        vboxguestdrivers: upgrade 6.1.32 -> 6.1.34

  Hitendra Prajapati (1):
        cyrus-sasl: CVE-2022-24407 failure to properly escape SQL input allows an attacker to execute arbitrary SQL commands

  Javier Viguera (1):
        networkmanager: fix build with enabled ppp

  Jeremy Puhlman (1):
        freeradius: mutlilib fixes

  Jiaqing Zhao (2):
        openldap: Remove libgcrypt dependency
        openldap: Upgrade 2.5.9 -> 2.5.12

  Joerg Vehlow (1):
        jq: Fix typo OE_EXTRACONF -> EXTRA_OECONF

  Julien STEPHAN (1):
        libcamera: fix packaging

  Kai Kang (4):
        conntrack-tools: fix postinst script
        python3-wxgtk4: backport patch to fix svg issue
        libportal: add distro features check
        graphviz: rrecommends on liberation-fonts

  Khem Raj (11):
        ufw: Fix packaging errors found with ppc64
        libcereal: Enable for glibc/ppc
        mimic: Use special rateconv.c license
        makedumpfile: Use right TARGET for ppc32
        evince: Add dbus to depnedencies on non-x11 builds
        evolution-data-server: Do not pass --library-path to gir compiler
        python3-wxgtk4: Needs x11 for sip module
        unattended-upgrades: Disable auto-detecting modules
        sdbus-c++: Link with libatomic on mips/ppc32
        sdbus-c++: Link with libatomic for rv32
        sdbus-c++-libsystemd: Fix patch fuzz

  Markus Volk (1):
        minidlna: fix obsolete license warning

  Martin Jansa (3):
        ostree: prevent ostree-native depending on target virtual/kernel to provide kernel-module-overlay
        leveldb: switch from master branch to main
        tesseract-lang: switch from master branch to main

  Michael Opdenacker (1):
        devmem2: update SRC_URI according to redirect

  Mingli Yu (1):
        s-nail: Set VAL_MTA

  Nicolas Dechesne (1):
        imlib2: update SRC_URI

  Peter Marko (1):
        libgpiod: move test dependencies to ptest package

  Richard Neill (1):
        bats: Add patch to fix false-negatives caused by teardown code

  Wentao Zhang (1):
        protobuf-c: update to 1.4.1 fix CVE-2022-33070

  Xu Huan (1):
        python3-astroid: upgrade 2.11.2 -> 2.11.3

  Yi Zhao (4):
        frr: inherit autotools-brokensep instead of autotools
        networkmanager: fix parallel build failure
        dnsmasq: Security fix CVE-2022-0934
        strongswan: upgrade 5.9.5 -> 5.9.6

  Yue Tao (2):
        exo: upgrade 4.16.3 -> 4.16.4
        dlt-daemon: upgrade to commit 6a3bd901d8 to fix CVE-2022-31291

  wangmy (5):
        php: upgrade 8.1.4 -> 8.1.5
        php: upgrade 8.1.5 -> 8.1.6
        postgresql: upgrade 14.2 -> 14.3
        postgresql: upgrade 14.3 -> 14.4
        php: upgrade 8.1.6 -> 8.1.7

meta-security: 93f2146211..c79262a30b:
  Anton Antonov (1):
        Parsec-service: Update installation procedure

  Armin Kuster (5):
        fscrypt: add distro_check on pam
        aide: Update 01.17.4
        tpm2-pkcs11: tpm2-pkcs11 module missing
        tpm2-tools: Add missing rdepends
        oeqa/cases/tpm2: fix and enhance test suite

  Davide Gardenal (1):
        sssd: ignore CVE-2018-16838

  Jeremy A. Puhlman (5):
        aide: Add depend on audit when audit is enabled.
        lib-perl: prefix man pages to avoid conflicting with base perl
        libmhash: add multilib header
        python3-privacyidea: add correct path to lib/privacyidea
        clamav: make install owner match the added user name

  Jose Quaresma (1):
        meta-integrity: kernel-modsign: prevents splitting out debug symbols

poky: d84c73d1ef..e4b5c35fd4:
  Ahmed Hossam (1):
        insane.bbclass: host-user-contaminated: Correct per package home path

  Alejandro Hernandez Samaniego (2):
        package.bbclass: Fix base directory for debugsource files when using externalsrc
        package.bbclass: Fix kernel source handling when not using externalsrc

  Alex Kiernan (1):
        pypi.bbclass: Set CVE_PRODUCT to PYPI_PACKAGE

  Alexander Kanavin (41):
        systemd: upgrade 250.4 -> 250.5
        mesa: upgrade 22.0.0 -> 22.0.2
        bind: upgrade 9.18.1 -> 9.18.2
        cronie: upgrade 1.6.0 -> 1.6.1
        epiphany: upgrade 42.0 -> 42.2
        ffmpeg: upgrade 5.0 -> 5.0.1
        fribidi: upgrade 1.0.11 -> 1.0.12
        libinput: upgrade 1.19.3 -> 1.19.4
        sqlite3: upgrade 3.38.2 -> 3.38.3
        webkitgtk: upgrade 2.36.0 -> 2.36.1
        xwayland: upgrade 22.1.0 -> 22.1.1
        mmc-utils: upgrade to latest revision
        gst-devtools: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-libav: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-omx: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-plugins-bad: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-plugins-base: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-plugins-good: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-plugins-ugly: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-python: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-rtsp-server: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0: upgrade 1.20.1 -> 1.20.2
        gstreamer1.0-vaapi: upgrade 1.20.1 -> 1.20.2
        libcgroup: upgrade 2.0.1 -> 2.0.2
        mesa: upgrade 22.0.2 -> 22.0.3
        mobile-broadband-provider-info: upgrade 20220315 -> 20220511
        sqlite3: upgrade 3.38.3 -> 3.38.5
        bash: submit patch upstream
        valgrind: submit arm patches upstream
        zip/unzip: mark all submittable patches as Inactive-Upstream
        python3: use built-in distutils for ptest, rather than setuptools' 'fork'
        wireless-regdb: upgrade 2022.04.08 -> 2022.06.06
        oeqa/sdk: drop the nativesdk-python 2.x test
        at: take tarballs from debian
        openssl: update 3.0.4 -> 3.0.5
        gstreamer1.0: upgrade 1.20.2 -> 1.20.3
        weston: update 10.0.0 -> 10.0.1
        glib-2.0: upgrade 2.72.2 -> 2.72.3
        glib-networking: upgrade 2.72.0 -> 2.72.1
        libsoup: upgrade 3.0.6 -> 3.0.7
        waffle: correctly request wayland-scanner executable

  Aryaman Gupta (1):
        e2fsprogs: update upstream status

  Bruce Ashfield (48):
        linux-yocto/5.10: update to v5.10.110
        linux-yocto/5.10: base: enable kernel crypto userspace API
        linux-yocto/5.10: update to v5.10.112
        linux-yocto/5.15: arm: poky-tiny cleanup and fixes
        linux-yocto/5.15: update to v5.15.33
        linux-yocto/5.15: base: enable kernel crypto userspace API
        linux-yocto/5.15: kasan: fix BUG: sleeping function called from invalid context
        linux-yocto/5.15: fix ppc boot
        linux-yocto/5.15: netfilter: conntrack: avoid useless indirection during conntrack destruction
        linux-yocto/5.15: update to v5.15.35
        linux-yocto/5.15: Fix CVE-2022-28796
        linux-yocto: enable powerpc debug fragment
        linux-yocto/5.15: fix -standard kernel build issue
        linux-yocto/5.15: update to v5.15.36
        linux-yocto/5.15: fix qemuarm graphical boot
        strace: fix ptest failure in landlock
        yocto-bsps: update to v5.15.36
        linux-yocto/5.15: update to v5.15.37
        linux-yocto/5.10: update to v5.10.113
        linux-yocto/5.15: update to v5.15.38
        linux-yocto/5.10: update to v5.10.114
        linux-yocto/5.15: bpf: explicitly disable unpriv eBPF by default
        linux-yocto/5.15: update to v5.15.43
        linux-yocto/5.10: update to v5.10.118
        linux-yocto/5.15: Enable MDIO bus config
        linux-yocto/5.15: cfg/xen: Move x86 configs to separate file
        linux-yocto/5.15: update to v5.15.44
        linux-yocto/5.10: update to v5.10.119
        lttng-modules: fix build against 5.18-rc7+
        linux-yocto/5.10: update to v5.10.121
        linux-yocto/5.10: update to v5.10.123
        linux-yocto/5.10: update to v5.10.128
        linux-yocto/5.10: fix build_OID_registry/conmakehash buildpaths warning
        linux-yocto/5.10: fix buildpaths issue with gen-mach-types
        linux-yocto/5.10: update to v5.10.130
        linux-yocto/5.10: fix buildpaths issue with pnmtologo
        linux-yocto/5.15: update to v5.15.46
        linux-yocto/5.15: update to v5.15.48
        linux-yocto/5.15: drop obselete GPIO sysfs ABI
        linux-yocto/5.15: update to v5.15.52
        linux-yocto/5.15: fix qemuppc buildpaths warning
        linux-yocto/5.15: fix build_OID_registry buildpaths warning
        linux-yocto/5.15: fix buildpaths issue with gen-mach-types
        linux-yocto/5.15: update to v5.15.54
        linux-yocto/5.15: fix buildpaths issue with pnmtologo
        kernel-devsrc: fix reproducibility and buildpaths QA warning
        kernel-devsrc: ppc32: fix reproducibility
        perf: fix reproducibility in 5.19+

  Chanho Park (2):
        cargo_common.bbclass: enable bitbake vendoring for externalsrc
        externalsrc.bbclass: support crate fetcher on externalsrc

  Chen Qi (1):
        go-helloworld: remove unused GO_WORKDIR

  Christoph Lauer (1):
        package.bbclass: Avoid stripping signed kernel modules in splitdebuginfo

  Claudius Heine (2):
        overlayfs: add docs about skipping QA check & service dependencies
        classes: rootfs-postcommands: add skip option to overlayfs_qa_check

  David Bagonyi (1):
        sanity.bbclass: Add ftps to accepted URI protocols for mirrors sanity

  Davide Gardenal (14):
        cve-check: add JSON format to summary output
        cve-check: fix symlinks where link and output path are equal
        rootfs-postcommands: fix symlinks where link and output path are equal
        openssl: minor security upgrade 3.0.2 -> 3.0.3
        freetype: backport patch for CVE-2022-27404
        freetype: backport patch for CVE-2022-27405
        freetype: backport patch for CVE-2022-27406
        qemu: backport patch for CVE-2021-4206
        qemu: backport patch for CVE-2021-4207
        base-passwd: Disable shell for default users
        libpcre2: upgrade 10.39 -> 10.40
        ncurses: update to patchlevel 20220423
        baremetal-image: fix broken symlink in do_rootfs
        efivar: add musl libc compatibility

  Dmitry Baryshkov (6):
        linux-firmware: upgrade 20220411 -> 20220509
        image.bbclass: allow overriding dependency on virtual/kernel:do_deploy
        linux-firmware: package new Qualcomm firmware
        linux-firmware: split ath3k firmware
        linux-firmware: add support for building snapshots
        linux-firmware: upgrade 20220509 -> 20220610

  Ernst Sjöstrand (2):
        cve-check: Add helper for symlink handling
        cve-check: Only include installed packages for rootfs manifest

  Felix Moessbauer (1):
        wic/plugins/rootfs: Fix permissions when splitting rootfs folders across partitions

  Gunjan Gupta (1):
        bitbake: fetch2/osc: Small fixes for osc fetcher

  He Zhe (1):
        lttng-modules: Fix build failure for 5.10.119+ and 5.15.44+ kernel

  Hitendra Prajapati (1):
        pcre2: CVE-2022-1586 Out-of-bounds read

  Jack Mitchell (1):
        meson.bbclass: add cython binary to cross/native toolchain config

  Jeremy Puhlman (1):
        gcc: depend on zstd-native

  Jiaqing Zhao (8):
        libxml2: Upgrade 2.9.13 -> 2.9.14
        sed: Specify shell for "nobody" user in run-ptest
        strace: Don't run ptest as "nobody"
        systemd: Drop 0001-test-parse-argument-Include-signal.h.patch
        systemd: Remove __compare_fn_t type in musl-specific patch
        systemd: Drop 0002-don-t-use-glibc-specific-qsort_r.patch
        systemd: Correct path returned in sd_path_lookup()
        systemd: Correct 0001-pass-correct-parameters-to-getdents64.patch

  Joerg Vehlow (1):
        libseccomp: Add missing files for ptests

  Jon Mason (2):
        poky-tiny: enable qemuarmv5/qemuarm64 and cleanups
        qemuarmv5: use arm-versatile-926ejs KMACHINE

  Jose Quaresma (3):
        archiver: use bb.note instead of echo
        archiver: don't use machine variables in shared recipes
        curl: backport openssl fix CN check error code

  Justin Bronder (1):
        pulseaudio: conditionally depend on alsa-plugins-pulseaudio-conf

  Kai Kang (2):
        xxhash: fix build with gcc 12
        glibc-tests: not clear BBCLASSEXTEND

  Khem Raj (11):
        kmod: Enable xz support by default
        qemu: Add packageconfig for libbpf support
        linux-yocto: Enable powerpc-debug fragment for ppc64 LE
        systemd: Fix build regression with latest update
        ovmf: Fix native build with gcc-12
        gcc: Upgrade to 11.3 release
        systemd: Drop redundant musl patches
        systemd: Document future actions needed for set of musl patches
        systemd: Drop 0016-Hide-__start_BUS_ERROR_MAP-and-__stop_BUS_ERROR_MAP.patch
        systemd: Update patch status
        libmodule-build-perl: Use env utility to find perl interpreter

  Konrad Weihmann (1):
        linux-firmware: replace mkdir by install

  Lee Chee Yang (1):
        ghostscript: fix CVE-2022-2085

  Lucas Stach (1):
        perf: sort-pmuevents: really keep array terminators

  Marcel Ziswiler (1):
        alsa-plugins: fix libavtp vs. avtp packageconfig

  Markus Volk (2):
        mesa.inc: package 00-radv-defaults.conf
        python3: Backport patch to fix an issue in subinterpreters

  Marta Rybczynska (9):
        cve-update-db-native: update the CVE database once a day only
        cve-update-db-native: let the user to drive the update interval
        cve-check: Fix report generation
        cve-check: move update_symlinks to a library
        cve-check: write empty fragment files in the text mode
        cve-check: fix return type in check_cves
        cve-update-db-native: make it possible to disable database updates
        cve-check: add support for Ignored CVEs
        oeqa/selftest/cve_check: add tests for Ignored and partial reports

  Martin Jansa (9):
        staging.bbclass: process direct dependencies in deterministic order
        insane.bbclass: make sure to close .patch files
        makedevs: Don't use COPYING.patch just to add license file into ${S}
        patch.py: make sure that patches/series file exists before quilt pop
        lttng-modules: fix shell syntax
        buildhistory.bbclass: fix shell syntax when using dash
        rootfs.py: close kernel_abi_ver_file
        mesa: backport a patch to support compositors without zwp_linux_dmabuf_v1 again
        wic: fix WicError message

  Matt Madison (1):
        bitbake: providers: use local variable for packages_dynamic pattern

  Maxime Roussin-Bélanger (1):
        libffi: fix native build being not portable

  Michael Opdenacker (4):
        rootfs-postcommands.bbclass: correct comments
        manuals: switch to the sstate mirror shared between all versions
        docs: BB_HASHSERVE_UPSTREAM: update to new host
        ref-manual: variables: remove sphinx directive from literal block

  Ming Liu (3):
        udev-extraconf: let automount base directory configurable
        udev-extraconf: fix some systemd automount issues
        udev-extraconf:mount.sh: fix path mismatching issues

  Mingli Yu (2):
        perl: Fix build with gcc-12
        oescripts: change compare logic in OEListPackageconfigTests

  Muhammad Hamza (6):
        initramfs-framework: move storage mounts to actual rootfs
        udev-extraconf/mount.sh: add LABELs to mountpoints
        udev-extraconf/mount.sh: save mount name in our tmp filecache
        udev-extraconf/mount.sh: only mount devices on hotplug
        udev-extraconf: force systemd-udevd to use shared MountFlags
        udev-extraconf/mount.sh: ignore lvm in automount

  Naveen Saini (1):
        pciutils: avoid lspci conflict with busybox

  Nick Potenski (1):
        systemd: systemd-systemctl: Support instance conf files during enable

  Pascal Bach (1):
        bin_package: install into base_prefix

  Paul Eggleton (4):
        devtool: ignore pn- overrides when determining SRC_URI overrides
        patch: handle if S points to a subdirectory of a git repo
        devtool: finish: handle patching when S points to subdir of a git repo
        oe-selftest: devtool: test modify git recipe building from a subdir

  Paulo Neves (2):
        python: Avoid shebang overflow on python-config.py
        gtk-doc: Fix potential shebang overflow on gtkdoc-mkhtml2

  Pavel Zhukov (3):
        bitbake.conf: Make TCLIBC and TCMODE lazy assigned
        systemd: update 0008-add-missing-FTW_-macros-for-musl.patch
        harfbuzz: Fix compilation with clang

  Peter Bergin (1):
        rust: fix issue building cross-canadian tools for aarch64 on x86_64

  Peter Kjellerstedt (4):
        license_image.bbclass: Make QA errors fail the build
        libseccomp: Correct LIC_FILES_CHKSUM
        license.bbclass: Bound beginline and endline in copy_license_files()
        base.bbclass: Correct the test for obsolete license exceptions

  Peter Marko (2):
        openssl: extract legacy provider module to a separate package
        alsa-state: correct license

  Pgowda (1):
        binutils : CVE-2019-1010204

  Portia (1):
        volatile-binds: Change DefaultDependencies from false to no

  Raju Kumar Pothuraju (1):
        kernel-uboot.bbclass: Use vmlinux.initramfs when INITRAMFS_IMAGE_BUNDLE set

  Rasmus Villemoes (1):
        e2fsprogs: add alternatives handling of lsattr as well

  Richard Purdie (79):
        bitbake: tests/parse: Fix one test overwriting another
        bitbake: server/process: Drop unused import
        bitbake: ui/buildinfohelper: Drop unused import
        bitbake: cooker: Drop unused loop
        bitbake: msg: Drop unused local variable
        bitbake: buildinfohelper: Drop unused function
        bitbake: fetch2/crate: Drop unused import
        bitbake: siggen: Drop pointless break statement
        bitbake: ui/knotty: Drop pointless pass statement
        bitbake: persist_data: Use a valid exception for missing implementation
        bitbake: runqueue: Drop pointless variable assignment
        bitbake: buildinfohelper: Drop unused variables
        bitbake: fetch2/osc: Add missing parameter
        bitbake: runqueue: Fix sig file location when using multiconfig
        bitbake: fetch/git : Use cat as pager
        lib/sstatesig: Fix find_siginfo to match sstate filename generation
        base: Avoid circular references to our own scripts
        scripts: Make git intercept global
        scripts/git: Ensure we don't have circular references
        package: Ensure we track whether PRSERV was active or not
        abi_version/sstate: Bump hashequiv and sstate versions due to git changes
        build-appliance-image: Update to kirkstone head revision
        vim: Upgrade 8.2.4681 -> 8.2.4912
        cairo: Add missing GPLv3 license checksum entry
        sanity: Don't warn about make 4.2.1 for mint
        bitbake: build: Add clean_stamp API function to allow removal of task stamps
        staging: Fix rare sysroot corruption issue
        selftest/imagefeatures/overlayfs: Always append to DISTRO_FEATURES
        vim: Upgrade 8.2.4912 -> 8.2.5034 to fix 9 CVEs
        tiff: Add jbig PACKAGECONFIG and clarify CVE-2022-1210
        libxslt: Mark CVE-2022-29824 as not applying
        cve-extra-exclusions: Add kernel CVEs
        cve-check: Allow warnings to be disabled
        rust-common: Fix sstate signatures between arm hf and non-hf
        rust-common: Drop LLVM_TARGET and simplify
        rust-common: Fix native signature dependency issues
        lzo: Add further info to a patch and mark as Inactive-Upstream
        glib-2.0: upgrade 2.72.1 -> 2.72.2
        libxkbcommon: upgrade 1.4.0 -> 1.4.1
        gtk+3: upgrade 3.24.33 -> 3.24.34
        webkitgtk: upgrade 2.36.1 -> 2.36.3
        openssl: Backport fix for ptest cert expiry
        gcc-cross-canadian: Add nativesdk-zstd dependency
        local.conf.sample: Update sstate url to new 'all' path
        sanity: Switch to make 4.0 as a minimum version
        perl: Add dependency on make-native to avoid race issues
        glibc: Drop make-native dependency
        vim: Upgrade 8.2.5034 -> 8.2.5083
        uboot-sign: Fix potential index error issues
        selftest/multiconfig: Test that multiconfigs in separate layers works
        gcc-source: Fix incorrect task dependencies from ${B}
        liberror-perl: Update sstate/equiv versions to clean cache
        python3: Remove problematic paths from sysroot files
        python3: Ensure stale empty python module directories don't break the build
        bitbake: server/process: Fix logging issues where only the first message was displayed
        build-appliance-image: Update to kirkstone head revision
        unzip: Port debian fixes for two CVEs
        cve-extra-exclusions: Clean up and ignore three CVEs (2xqemu and nasm)
        vim: 8.2.5083 -> 9.0.0005
        openssl: Upgrade 3.0.3 -> 3.0.4
        coreutils: Tweak packaging variable names for coreutils-dev
        oeqa/runtime/scp: Disable scp test for dropbear
        packagegroup-core-ssh-dropbear: Add openssh-sftp-server recommendation
        oe-selftest-image: Ensure the image has sftp as well as dropbear
        qemu: Avoid accidental librdmacm linkage
        glibc-tests: Avoid reproducibility issues
        qemu: Fix slirp determinism issue
        qemu: Add PACKAGECONFIG for brlapi
        gperf: Add a patch to work around reproducibility issues
        gperf: Switch to upstream patch
        udev-extraconf/initrdscripts/parted: Rename mount.blacklist -> mount.ignorelist
        insane: Fix buildpaths test to work with special devices
        lua: Fix multilib buildpath reproducibility issues
        vala: Fix on target wrapper buildpaths issue
        gtk-doc: Remove hardcoded buildpath
        kernel-arch: Fix buildpaths leaking into external module compiles
        gcc-runtime: Fix build when using gold
        gcc-runtime: Fix missing MLPREFIX in debug mappings
        selftest/runtime_test/virgl: Disable for all almalinux

  Robert Joslyn (3):
        powerpc: Remove invalid GLIBC_EXTRA_OECONF
        curl: Backport CVE fixes
        curl: Fix multiple CVEs

  Robert Yang (1):
        bitbake: fetch2/ssh.py: decode path back for ssh

  Roland Hieber (1):
        bitbake: cache: correctly handle file names containing colons

  Ross Burton (12):
        cve-check: no need to depend on the fetch task
        oeqa/selftest: add test for git working correctly inside pseudo
        Revert "bitbake.conf: mark all directories as safe for git to read"
        oeqa/selftest/cve_check: add tests for recipe and image reports
        tiff: mark CVE-2022-1622 and CVE-2022-1623 as invalid
        cups: ignore CVE-2022-26691
        busybox: fix CVE-2022-30065
        cve-check: hook cleanup to the BuildCompleted event, not CookerExit
        tiff: backport the fix for CVE-2022-2056, CVE-2022-2057, and CVE-2022-2058
        vim: upgrade to 9.0.0021
        perl: don't install Makefile.old into perl-ptest
        pulseaudio: add m4-native to DEPENDS

  Sakib Sajal (1):
        u-boot: fix CVE-2022-34835

  Samuli Piippo (1):
        binutils: Bump to latest 2.38 release branch

  Sean Anderson (1):
        rootfs.py: find .ko.zst kernel modules

  Stefan Wiehler (1):
        kernel-yocto.bbclass: Reset to exiting on non-zero return code at end of task

  Steve Sakoman (11):
        scripts/contrib/oe-build-perf-report-email.py: remove obsolete check for phantomjs and optipng
        poky.conf: bump version for 4.0.1 release
        virgl: skip headless test on alma 8.6
        python3: fix reproducibility issue with python3-core
        go: upgrade 1.17.8 -> 1.17.10
        poky.conf: bump version for 4.0.2
        openssh: break dependency on base package for -dev package
        dropbear: break dependency on base package for -dev package
        ruby: add PACKAGECONFIG for capstone
        qemu: add PACKAGECONFIG for capstone
        qemu: Avoid accidental libvdeplug linkage

  Sundeep KOKKONDA (4):
        rust-common: Ensure sstate signatures have correct dependencues for do_rust_gen_targets
        rust-common: Fix for target definitions returning 'NoneType' for arm
        glibc: stable 2.35 branch updates
        binutils : stable 2.38 branch updates

  Thomas Roos (1):
        recipetool/devtool: Fix python egg whitespace issues in PACKAGECONFIG

  Tomasz Dziendzielski (1):
        bitbake: data: Do not depend on vardepvalueexclude flag

  Wentao Zhang (1):
        harfbuzz: fix CVE-2022-33068

  Xiaobing Luo (1):
        devtool: Fix _copy_file() TypeError

  Yi Zhao (2):
        popt: fix override syntax in RDEPENDS
        git: fix override syntax in RDEPENDS

  leimaohui (1):
        cve-check.bbclass: Added do_populate_sdk[recrdeptask].

  wangmy (15):
        librepo: upgrade 1.14.2 -> 1.14.3
        cups: upgrade 2.4.1 -> 2.4.2
        logrotate: upgrade 3.19.0 -> 3.20.1
        iso-codes: upgrade 4.9.0 -> 4.10.0
        lttng-ust: upgrade 2.13.2 -> 2.13.3
        gst-devtools: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-libav: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-omx: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-plugins-bad: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-plugins-base: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-plugins-good: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-plugins-ugly: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-python: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-rtsp-server: upgrade 1.20.2 -> 1.20.3
        gstreamer1.0-vaapi: upgrade 1.20.2 -> 1.20.3

Signed-off-by: Patrick Williams <patrick@stwcx.xyz>
Change-Id: Ie30881bf20846b7311381bed443623fce8912406

15 files changed, 358 insertions, 53 deletions

diff --git a/poky/meta/lib/oe/cve_check.py b/poky/meta/lib/oe/cve_check.py
index dc7d2e2826..aa06497727 100644
--- a/poky/meta/lib/oe/cve_check.py
+++ b/poky/meta/lib/oe/cve_check.py
@@ -163,3 +163,13 @@ def cve_check_merge_jsons(output, data):
             return
 
     output["package"].append(data["package"][0])
+
+def update_symlinks(target_path, link_path):
+    """
+    Update a symbolic link link_path to point to target_path.
+    Remove the link and recreate it if exist and is different.
+    """
+    if link_path != target_path and os.path.exists(target_path):
+        if os.path.exists(os.path.realpath(link_path)):
+            os.remove(link_path)
+        os.symlink(os.path.basename(target_path), link_path)
diff --git a/poky/meta/lib/oe/patch.py b/poky/meta/lib/oe/patch.py
index 9034fcae03..4ec9caed45 100644
--- a/poky/meta/lib/oe/patch.py
+++ b/poky/meta/lib/oe/patch.py
@@ -299,10 +299,10 @@ class GitApplyTree(PatchTree):
         PatchTree.__init__(self, dir, d)
         self.commituser = d.getVar('PATCH_GIT_USER_NAME')
         self.commitemail = d.getVar('PATCH_GIT_USER_EMAIL')
-        if not self._isInitialized():
+        if not self._isInitialized(d):
             self._initRepo()
 
-    def _isInitialized(self):
+    def _isInitialized(self, d):
         cmd = "git rev-parse --show-toplevel"
         try:
             output = runcmd(cmd.split(), self.dir).strip()
@@ -310,8 +310,8 @@ class GitApplyTree(PatchTree):
             ## runcmd returned non-zero which most likely means 128
             ## Not a git directory
             return False
-        ## Make sure repo is in builddir to not break top-level git repos
-        return os.path.samefile(output, self.dir)
+        ## Make sure repo is in builddir to not break top-level git repos, or under workdir
+        return os.path.samefile(output, self.dir) or oe.path.is_path_parent(d.getVar('WORKDIR'), output)
 
     def _initRepo(self):
         runcmd("git init".split(), self.dir)
@@ -598,6 +598,8 @@ class QuiltTree(PatchSet):
 
     def Clean(self):
         try:
+            # make sure that patches/series file exists before quilt pop to keep quilt-0.67 happy
+            open(os.path.join(self.dir, "patches","series"), 'a').close()
             self._runcmd(["pop", "-a", "-f"])
             oe.path.remove(os.path.join(self.dir, "patches","series"))
         except Exception:
diff --git a/poky/meta/lib/oe/recipeutils.py b/poky/meta/lib/oe/recipeutils.py
index 872ff97b89..b04992c66d 100644
--- a/poky/meta/lib/oe/recipeutils.py
+++ b/poky/meta/lib/oe/recipeutils.py
@@ -666,7 +666,7 @@ def get_bbappend_path(d, destlayerdir, wildcardver=False):
     return (appendpath, pathok)
 
 
-def bbappend_recipe(rd, destlayerdir, srcfiles, install=None, wildcardver=False, machine=None, extralines=None, removevalues=None, redirect_output=None):
+def bbappend_recipe(rd, destlayerdir, srcfiles, install=None, wildcardver=False, machine=None, extralines=None, removevalues=None, redirect_output=None, params=None):
     """
     Writes a bbappend file for a recipe
     Parameters:
@@ -696,6 +696,9 @@ def bbappend_recipe(rd, destlayerdir, srcfiles, install=None, wildcardver=False,
         redirect_output:
             If specified, redirects writing the output file to the
             specified directory (for dry-run purposes)
+        params:
+            Parameters to use when adding entries to SRC_URI. If specified,
+            should be a list of dicts with the same length as srcfiles.
     """
 
     if not removevalues:
@@ -762,12 +765,14 @@ def bbappend_recipe(rd, destlayerdir, srcfiles, install=None, wildcardver=False,
     copyfiles = {}
     if srcfiles:
         instfunclines = []
-        for newfile, origsrcfile in srcfiles.items():
+        for i, (newfile, origsrcfile) in enumerate(srcfiles.items()):
             srcfile = origsrcfile
             srcurientry = None
             if not srcfile:
                 srcfile = os.path.basename(newfile)
                 srcurientry = 'file://%s' % srcfile
+                if params and params[i]:
+                    srcurientry = '%s;%s' % (srcurientry, ';'.join('%s=%s' % (k,v) for k,v in params[i].items()))
                 # Double-check it's not there already
                 # FIXME do we care if the entry is added by another bbappend that might go away?
                 if not srcurientry in rd.getVar('SRC_URI').split():
diff --git a/poky/meta/lib/oe/rootfs.py b/poky/meta/lib/oe/rootfs.py
index 98cf3f244d..9e6b411fb6 100644
--- a/poky/meta/lib/oe/rootfs.py
+++ b/poky/meta/lib/oe/rootfs.py
@@ -311,7 +311,7 @@ class Rootfs(object, metaclass=ABCMeta):
     def _check_for_kernel_modules(self, modules_dir):
         for root, dirs, files in os.walk(modules_dir, topdown=True):
             for name in files:
-                found_ko = name.endswith((".ko", ".ko.gz", ".ko.xz"))
+                found_ko = name.endswith((".ko", ".ko.gz", ".ko.xz", ".ko.zst"))
                 if found_ko:
                     return found_ko
         return False
@@ -328,7 +328,9 @@ class Rootfs(object, metaclass=ABCMeta):
         if not os.path.exists(kernel_abi_ver_file):
             bb.fatal("No kernel-abiversion file found (%s), cannot run depmod, aborting" % kernel_abi_ver_file)
 
-        kernel_ver = open(kernel_abi_ver_file).read().strip(' \n')
+        with open(kernel_abi_ver_file) as f:
+            kernel_ver = f.read().strip(' \n')
+
         versioned_modules_dir = os.path.join(self.image_rootfs, modules_dir, kernel_ver)
 
         bb.utils.mkdirhier(versioned_modules_dir)
diff --git a/poky/meta/lib/oe/sstatesig.py b/poky/meta/lib/oe/sstatesig.py
index 2cf858e201..7150bd0929 100644
--- a/poky/meta/lib/oe/sstatesig.py
+++ b/poky/meta/lib/oe/sstatesig.py
@@ -382,13 +382,13 @@ def find_siginfo(pn, taskname, taskhashlist, d):
             localdata.setVar('PV', '*')
             localdata.setVar('PR', '*')
             localdata.setVar('BB_TASKHASH', hashval)
+            localdata.setVar('SSTATE_CURRTASK', taskname[3:])
             swspec = localdata.getVar('SSTATE_SWSPEC')
             if taskname in ['do_fetch', 'do_unpack', 'do_patch', 'do_populate_lic', 'do_preconfigure'] and swspec:
                 localdata.setVar('SSTATE_PKGSPEC', '${SSTATE_SWSPEC}')
             elif pn.endswith('-native') or "-cross-" in pn or "-crosssdk-" in pn:
                 localdata.setVar('SSTATE_EXTRAPATH', "${NATIVELSBSTRING}/")
-            sstatename = taskname[3:]
-            filespec = '%s_%s.*.siginfo' % (localdata.getVar('SSTATE_PKG'), sstatename)
+            filespec = '%s.siginfo' % localdata.getVar('SSTATE_PKG')
 
             matchedfiles = glob.glob(filespec)
             for fullpath in matchedfiles:
diff --git a/poky/meta/lib/oeqa/runtime/cases/scp.py b/poky/meta/lib/oeqa/runtime/cases/scp.py
index 3a5f292152..f2bbc947d6 100644
--- a/poky/meta/lib/oeqa/runtime/cases/scp.py
+++ b/poky/meta/lib/oeqa/runtime/cases/scp.py
@@ -23,7 +23,7 @@ class ScpTest(OERuntimeTestCase):
         os.remove(cls.tmp_path)
 
     @OETestDepends(['ssh.SSHTest.test_ssh'])
-    @OEHasPackage(['openssh-scp', 'dropbear'])
+    @OEHasPackage(['openssh-scp'])
     def test_scp_file(self):
         dst = '/tmp/test_scp_file'
 
diff --git a/poky/meta/lib/oeqa/sdk/cases/python.py b/poky/meta/lib/oeqa/sdk/cases/python.py
index a334abce5f..d43354c32a 100644
--- a/poky/meta/lib/oeqa/sdk/cases/python.py
+++ b/poky/meta/lib/oeqa/sdk/cases/python.py
@@ -8,17 +8,6 @@ from oeqa.sdk.case import OESDKTestCase
 from oeqa.utils.subprocesstweak import errors_have_output
 errors_have_output()
 
-class Python2Test(OESDKTestCase):
-    def setUp(self):
-        if not (self.tc.hasHostPackage("nativesdk-python-core") or
-                self.tc.hasHostPackage("python-core-native")):
-            raise unittest.SkipTest("No python package in the SDK")
-
-    def test_python2(self):
-        cmd = "python -c \"import codecs; print(codecs.encode('Uryyb, jbeyq', 'rot13'))\""
-        output = self._run(cmd)
-        self.assertEqual(output, "Hello, world\n")
-
 class Python3Test(OESDKTestCase):
     def setUp(self):
         if not (self.tc.hasHostPackage("nativesdk-python3-core") or
diff --git a/poky/meta/lib/oeqa/selftest/cases/cve_check.py b/poky/meta/lib/oeqa/selftest/cases/cve_check.py
index d1947baffc..d0b2213703 100644
--- a/poky/meta/lib/oeqa/selftest/cases/cve_check.py
+++ b/poky/meta/lib/oeqa/selftest/cases/cve_check.py
@@ -1,9 +1,13 @@
-from oe.cve_check import Version
+import json
+import os
 from oeqa.selftest.case import OESelftestTestCase
+from oeqa.utils.commands import bitbake, get_bb_vars
 
 class CVECheck(OESelftestTestCase):
 
     def test_version_compare(self):
+        from oe.cve_check import Version
+
         result = Version("100") > Version("99")
         self.assertTrue( result, msg="Failed to compare version '100' > '99'")
         result = Version("2.3.1") > Version("2.2.3")
@@ -42,3 +46,156 @@ class CVECheck(OESelftestTestCase):
         self.assertTrue( result ,msg="Failed to compare version with suffix '1.0p2' > '1.0p1'")
         result = Version("1.0_patch2","patch") < Version("1.0_patch3","patch")
         self.assertTrue( result ,msg="Failed to compare version with suffix '1.0_patch2' < '1.0_patch3'")
+
+
+    def test_recipe_report_json(self):
+        config = """
+INHERIT += "cve-check"
+CVE_CHECK_FORMAT_JSON = "1"
+"""
+        self.write_config(config)
+
+        vars = get_bb_vars(["CVE_CHECK_SUMMARY_DIR", "CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        summary_json = os.path.join(vars["CVE_CHECK_SUMMARY_DIR"], vars["CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        recipe_json = os.path.join(vars["CVE_CHECK_SUMMARY_DIR"], "m4-native_cve.json")
+
+        try:
+            os.remove(summary_json)
+            os.remove(recipe_json)
+        except FileNotFoundError:
+            pass
+
+        bitbake("m4-native -c cve_check")
+
+        def check_m4_json(filename):
+            with open(filename) as f:
+                report = json.load(f)
+            self.assertEqual(report["version"], "1")
+            self.assertEqual(len(report["package"]), 1)
+            package = report["package"][0]
+            self.assertEqual(package["name"], "m4-native")
+            found_cves = { issue["id"]: issue["status"] for issue in package["issue"]}
+            self.assertIn("CVE-2008-1687", found_cves)
+            self.assertEqual(found_cves["CVE-2008-1687"], "Patched")
+
+        self.assertExists(summary_json)
+        check_m4_json(summary_json)
+        self.assertExists(recipe_json)
+        check_m4_json(recipe_json)
+
+
+    def test_image_json(self):
+        config = """
+INHERIT += "cve-check"
+CVE_CHECK_FORMAT_JSON = "1"
+"""
+        self.write_config(config)
+
+        vars = get_bb_vars(["CVE_CHECK_DIR", "CVE_CHECK_SUMMARY_DIR", "CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        report_json = os.path.join(vars["CVE_CHECK_SUMMARY_DIR"], vars["CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        print(report_json)
+        try:
+            os.remove(report_json)
+        except FileNotFoundError:
+            pass
+
+        bitbake("core-image-minimal-initramfs")
+        self.assertExists(report_json)
+
+        # Check that the summary report lists at least one package
+        with open(report_json) as f:
+            report = json.load(f)
+        self.assertEqual(report["version"], "1")
+        self.assertGreater(len(report["package"]), 1)
+
+        # Check that a random recipe wrote a recipe report to deploy/cve/
+        recipename = report["package"][0]["name"]
+        recipe_report = os.path.join(vars["CVE_CHECK_DIR"], recipename + "_cve.json")
+        self.assertExists(recipe_report)
+        with open(recipe_report) as f:
+            report = json.load(f)
+        self.assertEqual(report["version"], "1")
+        self.assertEqual(len(report["package"]), 1)
+        self.assertEqual(report["package"][0]["name"], recipename)
+
+
+    def test_recipe_report_json_unpatched(self):
+        config = """
+INHERIT += "cve-check"
+CVE_CHECK_FORMAT_JSON = "1"
+CVE_CHECK_REPORT_PATCHED = "0"
+"""
+        self.write_config(config)
+
+        vars = get_bb_vars(["CVE_CHECK_SUMMARY_DIR", "CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        summary_json = os.path.join(vars["CVE_CHECK_SUMMARY_DIR"], vars["CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        recipe_json = os.path.join(vars["CVE_CHECK_SUMMARY_DIR"], "m4-native_cve.json")
+
+        try:
+            os.remove(summary_json)
+            os.remove(recipe_json)
+        except FileNotFoundError:
+            pass
+
+        bitbake("m4-native -c cve_check")
+
+        def check_m4_json(filename):
+            with open(filename) as f:
+                report = json.load(f)
+            self.assertEqual(report["version"], "1")
+            self.assertEqual(len(report["package"]), 1)
+            package = report["package"][0]
+            self.assertEqual(package["name"], "m4-native")
+            #m4 had only Patched CVEs, so the issues array will be empty
+            self.assertEqual(package["issue"], [])
+
+        self.assertExists(summary_json)
+        check_m4_json(summary_json)
+        self.assertExists(recipe_json)
+        check_m4_json(recipe_json)
+
+
+    def test_recipe_report_json_ignored(self):
+        config = """
+INHERIT += "cve-check"
+CVE_CHECK_FORMAT_JSON = "1"
+CVE_CHECK_REPORT_PATCHED = "1"
+"""
+        self.write_config(config)
+
+        vars = get_bb_vars(["CVE_CHECK_SUMMARY_DIR", "CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        summary_json = os.path.join(vars["CVE_CHECK_SUMMARY_DIR"], vars["CVE_CHECK_SUMMARY_FILE_NAME_JSON"])
+        recipe_json = os.path.join(vars["CVE_CHECK_SUMMARY_DIR"], "logrotate_cve.json")
+
+        try:
+            os.remove(summary_json)
+            os.remove(recipe_json)
+        except FileNotFoundError:
+            pass
+
+        bitbake("logrotate -c cve_check")
+
+        def check_m4_json(filename):
+            with open(filename) as f:
+                report = json.load(f)
+            self.assertEqual(report["version"], "1")
+            self.assertEqual(len(report["package"]), 1)
+            package = report["package"][0]
+            self.assertEqual(package["name"], "logrotate")
+            found_cves = { issue["id"]: issue["status"] for issue in package["issue"]}
+            # m4 CVE should not be in logrotate
+            self.assertNotIn("CVE-2008-1687", found_cves)
+            # logrotate has both Patched and Ignored CVEs
+            self.assertIn("CVE-2011-1098", found_cves)
+            self.assertEqual(found_cves["CVE-2011-1098"], "Patched")
+            self.assertIn("CVE-2011-1548", found_cves)
+            self.assertEqual(found_cves["CVE-2011-1548"], "Ignored")
+            self.assertIn("CVE-2011-1549", found_cves)
+            self.assertEqual(found_cves["CVE-2011-1549"], "Ignored")
+            self.assertIn("CVE-2011-1550", found_cves)
+            self.assertEqual(found_cves["CVE-2011-1550"], "Ignored")
+
+        self.assertExists(summary_json)
+        check_m4_json(summary_json)
+        self.assertExists(recipe_json)
+        check_m4_json(recipe_json)
diff --git a/poky/meta/lib/oeqa/selftest/cases/devtool.py b/poky/meta/lib/oeqa/selftest/cases/devtool.py
index 3eea2b1a0e..34fc791f3a 100644
--- a/poky/meta/lib/oeqa/selftest/cases/devtool.py
+++ b/poky/meta/lib/oeqa/selftest/cases/devtool.py
@@ -218,6 +218,34 @@ class DevtoolTestCase(OESelftestTestCase):
             filelist.append(' '.join(splitline))
         return filelist
 
+    def _check_diff(self, diffoutput, addlines, removelines):
+        """Check output from 'git diff' matches expectation"""
+        remaining_addlines = addlines[:]
+        remaining_removelines = removelines[:]
+        for line in diffoutput.splitlines():
+            if line.startswith('+++') or line.startswith('---'):
+                continue
+            elif line.startswith('+'):
+                matched = False
+                for item in addlines:
+                    if re.match(item, line[1:].strip()):
+                        matched = True
+                        remaining_addlines.remove(item)
+                        break
+                self.assertTrue(matched, 'Unexpected diff add line: %s' % line)
+            elif line.startswith('-'):
+                matched = False
+                for item in removelines:
+                    if re.match(item, line[1:].strip()):
+                        matched = True
+                        remaining_removelines.remove(item)
+                        break
+                self.assertTrue(matched, 'Unexpected diff remove line: %s' % line)
+        if remaining_addlines:
+            self.fail('Expected added lines not found: %s' % remaining_addlines)
+        if remaining_removelines:
+            self.fail('Expected removed lines not found: %s' % remaining_removelines)
+
 
 class DevtoolBase(DevtoolTestCase):
 
@@ -444,7 +472,7 @@ class DevtoolAddTests(DevtoolBase):
         checkvars['S'] = '${WORKDIR}/MarkupSafe-%s' % testver
         checkvars['SRC_URI'] = url
         self._test_recipe_contents(recipefile, checkvars, [])
-
+     
     def test_devtool_add_fetch_git(self):
         tempdir = tempfile.mkdtemp(prefix='devtoolqa')
         self.track_for_cleanup(tempdir)
@@ -544,6 +572,19 @@ class DevtoolAddTests(DevtoolBase):
         # Test devtool build
         result = runCmd('devtool build %s' % pn)
 
+    def test_devtool_add_python_egg_requires(self):
+        # Fetch source
+        tempdir = tempfile.mkdtemp(prefix='devtoolqa')
+        self.track_for_cleanup(tempdir)
+        testver = '0.14.0'
+        url = 'https://files.pythonhosted.org/packages/e9/9e/25d59f5043cf763833b2581c8027fa92342c4cf8ee523b498ecdf460c16d/uvicorn-%s.tar.gz' % testver
+        testrecipe = 'python3-uvicorn'
+        srcdir = os.path.join(tempdir, testrecipe)
+        # Test devtool add
+        self.track_for_cleanup(self.workspacedir)
+        self.add_command_to_tearDown('bitbake-layers remove-layer */workspace')
+        result = runCmd('devtool add %s %s -f %s' % (testrecipe, srcdir, url))
+
 class DevtoolModifyTests(DevtoolBase):
 
     def test_devtool_modify(self):
@@ -705,6 +746,7 @@ class DevtoolModifyTests(DevtoolBase):
 
         self.assertTrue(bbclassextended, 'None of these recipes are BBCLASSEXTENDed to native - need to adjust testrecipes list: %s' % ', '.join(testrecipes))
         self.assertTrue(inheritnative, 'None of these recipes do "inherit native" - need to adjust testrecipes list: %s' % ', '.join(testrecipes))
+
     def test_devtool_modify_localfiles_only(self):
         # Check preconditions
         testrecipe = 'base-files'
@@ -917,23 +959,7 @@ class DevtoolUpdateTests(DevtoolBase):
         srcurilines[0] = 'SRC_URI = "' + srcurilines[0]
         srcurilines.append('"')
         removelines = ['SRCREV = ".*"'] + srcurilines
-        for line in result.output.splitlines():
-            if line.startswith('+++') or line.startswith('---'):
-                continue
-            elif line.startswith('+'):
-                matched = False
-                for item in addlines:
-                    if re.match(item, line[1:].strip()):
-                        matched = True
-                        break
-                self.assertTrue(matched, 'Unexpected diff add line: %s' % line)
-            elif line.startswith('-'):
-                matched = False
-                for item in removelines:
-                    if re.match(item, line[1:].strip()):
-                        matched = True
-                        break
-                self.assertTrue(matched, 'Unexpected diff remove line: %s' % line)
+        self._check_diff(result.output, addlines, removelines)
         # Now try with auto mode
         runCmd('cd %s; git checkout %s %s' % (os.path.dirname(recipefile), testrecipe, os.path.basename(recipefile)))
         result = runCmd('devtool update-recipe %s' % testrecipe)
@@ -1303,6 +1329,73 @@ class DevtoolUpdateTests(DevtoolBase):
         expected_status = []
         self._check_repo_status(os.path.dirname(recipefile), expected_status)
 
+    def test_devtool_finish_modify_git_subdir(self):
+        # Check preconditions
+        testrecipe = 'dos2unix'
+        bb_vars = get_bb_vars(['SRC_URI', 'S', 'WORKDIR', 'FILE'], testrecipe)
+        self.assertIn('git://', bb_vars['SRC_URI'], 'This test expects the %s recipe to be a git recipe' % testrecipe)
+        workdir_git = '%s/git/' % bb_vars['WORKDIR']
+        if not bb_vars['S'].startswith(workdir_git):
+            self.fail('This test expects the %s recipe to be building from a subdirectory of the git repo' % testrecipe)
+        subdir = bb_vars['S'].split(workdir_git, 1)[1]
+        # Clean up anything in the workdir/sysroot/sstate cache
+        bitbake('%s -c cleansstate' % testrecipe)
+        # Try modifying a recipe
+        tempdir = tempfile.mkdtemp(prefix='devtoolqa')
+        self.track_for_cleanup(tempdir)
+        self.track_for_cleanup(self.workspacedir)
+        self.add_command_to_tearDown('bitbake -c clean %s' % testrecipe)
+        self.add_command_to_tearDown('bitbake-layers remove-layer */workspace')
+        result = runCmd('devtool modify %s -x %s' % (testrecipe, tempdir))
+        testsrcfile = os.path.join(tempdir, subdir, 'dos2unix.c')
+        self.assertExists(testsrcfile, 'Extracted source could not be found')
+        self.assertExists(os.path.join(self.workspacedir, 'conf', 'layer.conf'), 'Workspace directory not created. devtool output: %s' % result.output)
+        self.assertNotExists(os.path.join(tempdir, subdir, '.git'), 'Subdirectory has been initialised as a git repo')
+        # Check git repo
+        self._check_src_repo(tempdir)
+        # Modify file
+        runCmd("sed -i '1s:^:/* Add a comment */\\n:' %s" % testsrcfile)
+        result = runCmd('git commit -a -m "Add a comment"', cwd=tempdir)
+        # Now try updating original recipe
+        recipefile = bb_vars['FILE']
+        recipedir = os.path.dirname(recipefile)
+        self.add_command_to_tearDown('cd %s; rm -f %s/*.patch; git checkout .' % (recipedir, testrecipe))
+        result = runCmd('devtool update-recipe %s' % testrecipe)
+        expected_status = [(' M', '.*/%s$' % os.path.basename(recipefile)),
+                           ('??', '.*/%s/%s/$' % (testrecipe, testrecipe))]
+        self._check_repo_status(os.path.dirname(recipefile), expected_status)
+        result = runCmd('git diff %s' % os.path.basename(recipefile), cwd=os.path.dirname(recipefile))
+        removelines = ['SRC_URI = "git://.*"']
+        addlines = [
+            'SRC_URI = "git://.* \\\\',
+            'file://0001-Add-a-comment.patch;patchdir=.. \\\\',
+            '"'
+        ]
+        self._check_diff(result.output, addlines, removelines)
+        # Put things back so we can run devtool finish on a different layer
+        runCmd('cd %s; rm -f %s/*.patch; git checkout .' % (recipedir, testrecipe))
+        # Run devtool finish
+        res = re.search('recipes-.*', recipedir)
+        self.assertTrue(res, 'Unable to find recipe subdirectory')
+        recipesubdir = res[0]
+        self.add_command_to_tearDown('rm -rf %s' % os.path.join(self.testlayer_path, recipesubdir))
+        result = runCmd('devtool finish %s meta-selftest' % testrecipe)
+        # Check bbappend file contents
+        appendfn = os.path.join(self.testlayer_path, recipesubdir, '%s_%%.bbappend' % testrecipe)
+        with open(appendfn, 'r') as f:
+            appendlines = f.readlines()
+        expected_appendlines = [
+            'FILESEXTRAPATHS:prepend := "${THISDIR}/${PN}:"\n',
+            '\n',
+            'SRC_URI += "file://0001-Add-a-comment.patch;patchdir=.."\n',
+            '\n'
+        ]
+        self.assertEqual(appendlines, expected_appendlines)
+        self.assertExists(os.path.join(os.path.dirname(appendfn), testrecipe, '0001-Add-a-comment.patch'))
+        # Try building
+        bitbake('%s -c patch' % testrecipe)
+
+
 class DevtoolExtractTests(DevtoolBase):
 
     def test_devtool_extract(self):
diff --git a/poky/meta/lib/oeqa/selftest/cases/git.py b/poky/meta/lib/oeqa/selftest/cases/git.py
new file mode 100644
index 0000000000..f12874dc7d
--- /dev/null
+++ b/poky/meta/lib/oeqa/selftest/cases/git.py
@@ -0,0 +1,15 @@
+from oeqa.selftest.case import OESelftestTestCase
+from oeqa.utils.commands import bitbake
+
+class GitCheck(OESelftestTestCase):
+    def test_git_intercept(self):
+        """
+        Git binaries with CVE-2022-24765 fixed will refuse to operate on a
+        repository which is owned by a different user. This breaks our
+        do_install task as that runs inside pseudo, so the git repository is
+        owned by the build user but git is running as (fake)root.
+
+        We have an intercept which disables pseudo, so verify that it works.
+        """
+        bitbake("git-submodule-test -c test_git_as_user")
+        bitbake("git-submodule-test -c test_git_as_root")
diff --git a/poky/meta/lib/oeqa/selftest/cases/imagefeatures.py b/poky/meta/lib/oeqa/selftest/cases/imagefeatures.py
index 6b94ace4eb..6d010b3e3a 100644
--- a/poky/meta/lib/oeqa/selftest/cases/imagefeatures.py
+++ b/poky/meta/lib/oeqa/selftest/cases/imagefeatures.py
@@ -235,7 +235,7 @@ USERADD_GID_TABLES += "files/static-group"
 DISTRO_FEATURES:append = " pam opengl wayland"
 
 # Switch to systemd
-DISTRO_FEATURES += "systemd"
+DISTRO_FEATURES:append = " systemd"
 VIRTUAL-RUNTIME_init_manager = "systemd"
 VIRTUAL-RUNTIME_initscripts = ""
 VIRTUAL-RUNTIME_syslog = ""
diff --git a/poky/meta/lib/oeqa/selftest/cases/multiconfig.py b/poky/meta/lib/oeqa/selftest/cases/multiconfig.py
index baae9b456f..83cbd1345d 100644
--- a/poky/meta/lib/oeqa/selftest/cases/multiconfig.py
+++ b/poky/meta/lib/oeqa/selftest/cases/multiconfig.py
@@ -70,3 +70,16 @@ TMPDIR = "${TOPDIR}/tmp-mc-tiny"
 
         result = bitbake('mc:test:multiconfig-test-parse -c showvar')
         self.assertIn('MCTESTVAR=test2', result.output.splitlines())
+
+    def test_multiconfig_inlayer(self):
+        """
+        Test that a multiconfig from meta-selftest works.
+        """
+
+        config = """
+BBMULTICONFIG = "muslmc"
+"""
+        self.write_config(config)
+
+        # Build a core-image-minimal, only dry run needed to check config is present
+        bitbake('mc:muslmc:bash -n')
diff --git a/poky/meta/lib/oeqa/selftest/cases/oescripts.py b/poky/meta/lib/oeqa/selftest/cases/oescripts.py
index cd687816c8..bd84f151cb 100644
--- a/poky/meta/lib/oeqa/selftest/cases/oescripts.py
+++ b/poky/meta/lib/oeqa/selftest/cases/oescripts.py
@@ -129,7 +129,8 @@ class OEListPackageconfigTests(OEScriptTests):
     def check_endlines(self, results,  expected_endlines): 
         for line in results.output.splitlines():
             for el in expected_endlines:
-                if line.split() == el.split():
+                if line and line.split()[0] == el.split()[0] and \
+                   ' '.join(sorted(el.split())) in ' '.join(sorted(line.split())):
                     expected_endlines.remove(el)
                     break
 
diff --git a/poky/meta/lib/oeqa/selftest/cases/overlayfs.py b/poky/meta/lib/oeqa/selftest/cases/overlayfs.py
index 472746a64f..96beb8b869 100644
--- a/poky/meta/lib/oeqa/selftest/cases/overlayfs.py
+++ b/poky/meta/lib/oeqa/selftest/cases/overlayfs.py
@@ -55,18 +55,36 @@ inherit overlayfs
 
         config = """
 IMAGE_INSTALL:append = " overlayfs-user"
-DISTRO_FEATURES += "systemd overlayfs"
+DISTRO_FEATURES:append = " systemd overlayfs"
 """
 
         self.write_config(config)
         self.add_overlay_conf_to_machine()
 
         res = bitbake('core-image-minimal', ignore_status=True)
-        line = getline(res, " Mount path /mnt/overlay not found in fstat and unit mnt-overlay.mount not found in systemd unit directories")
+        line = getline(res, " Mount path /mnt/overlay not found in fstab and unit mnt-overlay.mount not found in systemd unit directories")
         self.assertTrue(line and line.startswith("WARNING:"), msg=res.output)
         line = getline(res, "Not all mount paths and units are installed in the image")
         self.assertTrue(line and line.startswith("ERROR:"), msg=res.output)
 
+    def test_not_all_units_installed_but_qa_skipped(self):
+        """
+        Summary:   Test skipping the QA check
+        Expected:  Image is created successfully
+        Author:    Claudius Heine <ch@denx.de>
+        """
+
+        config = """
+IMAGE_INSTALL:append = " overlayfs-user"
+DISTRO_FEATURES += "systemd overlayfs"
+OVERLAYFS_QA_SKIP[mnt-overlay] = "mount-configured"
+"""
+
+        self.write_config(config)
+        self.add_overlay_conf_to_machine()
+
+        bitbake('core-image-minimal')
+
     def test_mount_unit_not_set(self):
         """
         Summary:   Test whether mount unit was set properly
@@ -76,7 +94,7 @@ DISTRO_FEATURES += "systemd overlayfs"
 
         config = """
 IMAGE_INSTALL:append = " overlayfs-user"
-DISTRO_FEATURES += "systemd overlayfs"
+DISTRO_FEATURES:append = " systemd overlayfs"
 """
 
         self.write_config(config)
@@ -94,7 +112,7 @@ DISTRO_FEATURES += "systemd overlayfs"
 
         config = """
 IMAGE_INSTALL:append = " overlayfs-user"
-DISTRO_FEATURES += "systemd overlayfs"
+DISTRO_FEATURES:append = " systemd overlayfs"
 """
 
         wrong_machine_config = """
@@ -118,7 +136,7 @@ OVERLAYFS_MOUNT_POINT[usr-share-overlay] = "/usr/share/overlay"
 
         config = """
 IMAGE_INSTALL:append = " overlayfs-user systemd-machine-units"
-DISTRO_FEATURES += "systemd overlayfs"
+DISTRO_FEATURES:append = " systemd overlayfs"
 
 # Use systemd as init manager
 VIRTUAL-RUNTIME_init_manager = "systemd"
@@ -253,7 +271,7 @@ class OverlayFSEtcRunTimeTests(OESelftestTestCase):
         """
 
         configBase = """
-DISTRO_FEATURES += "systemd"
+DISTRO_FEATURES:append = " systemd"
 
 # Use systemd as init manager
 VIRTUAL-RUNTIME_init_manager = "systemd"
@@ -295,7 +313,7 @@ OVERLAYFS_ETC_DEVICE = "/dev/mmcblk0p1"
         """
 
         config = """
-DISTRO_FEATURES += "systemd"
+DISTRO_FEATURES:append = " systemd"
 
 # Use systemd as init manager
 VIRTUAL-RUNTIME_init_manager = "systemd"
@@ -331,7 +349,7 @@ INHERIT += "overlayfs-etc"
         """
 
         config = f"""
-DISTRO_FEATURES += "systemd"
+DISTRO_FEATURES:append = " systemd"
 
 # Use systemd as init manager
 VIRTUAL-RUNTIME_init_manager = "systemd"
@@ -373,7 +391,7 @@ OVERLAYFS_ETC_DEVICE = "/dev/sda3"
         """
 
         config = """
-DISTRO_FEATURES += "systemd"
+DISTRO_FEATURES:append = " systemd"
 
 # Use systemd as init manager
 VIRTUAL-RUNTIME_init_manager = "systemd"
diff --git a/poky/meta/lib/oeqa/selftest/cases/runtime_test.py b/poky/meta/lib/oeqa/selftest/cases/runtime_test.py
index 3ece617cb0..857737f730 100644
--- a/poky/meta/lib/oeqa/selftest/cases/runtime_test.py
+++ b/poky/meta/lib/oeqa/selftest/cases/runtime_test.py
@@ -252,7 +252,7 @@ class TestImage(OESelftestTestCase):
         import subprocess, os
 
         distro = oe.lsb.distro_identifier()
-        if distro and distro in ['debian-9', 'debian-10', 'centos-7', 'centos-8', 'ubuntu-16.04', 'ubuntu-18.04', 'almalinux-8.5']:
+        if distro and (distro in ['debian-9', 'debian-10', 'centos-7', 'centos-8', 'ubuntu-16.04', 'ubuntu-18.04'] or distro.startswith('almalinux')):
             self.skipTest('virgl headless cannot be tested with %s' %(distro))
 
         render_hint = """If /dev/dri/renderD* is absent due to lack of suitable GPU, 'modprobe vgem' will create one suitable for mesa llvmpipe software renderer."""