| Message ID | db02a4cc542d0e7e563ec46c91bf9a7313a71d02.1750176125.git.steve@sakoman.com |
|---|---|
| State | New |
| Headers | show |
| Series | [scarthgap,1/8] net-tools: patch CVE-2025-46836 | expand |
On 6/17/25 18:04, Steve Sakoman via lists.openembedded.org wrote: > From: Savvas Etairidis <setairidis@gmail.com> > > The recipe was accidentally renamed with a 'v' > prefix in 29e623b2ad00555788412fa520fbb9ffec794cbb. > > Signed-off-by: Savvas Etairidis <setairidis@gmail.com> > Signed-off-by: Steve Sakoman <steve@sakoman.com> > --- > .../systemd/{systemd_v255.21.bb => systemd_255.21.bb} | 0 > 1 file changed, 0 insertions(+), 0 deletions(-) > rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%) > Personally I'm not affected by this issue, and have no problem with this patch, but a few weeks ago there were people who were unhappy when a similar issue popped up in Walnascar with autoconf (though it was caught before merging), which makes me wonder if this is the way to go. Systemd already has a PE[1], exactly because of the same situation: "v" was removed from the start of ${PV} - maybe it's time to bump. Anyway, as this patch does no harm to me, this is not a complaint against it, but I thought it would be worth to mention it at least. [1]: https://git.yoctoproject.org/poky/commit/?id=f95bbe35b2aab929e50471db8ba50781d5027a01
The author's V1 patch bumped PE. I replied to that patch, asking the author to not bump PE. My reason is that we'll need to bump PE in later releases too (walnascar, master) if we bump PE in scarthgap. Regards, Qi On 6/18/25 15:08, Gyorgy Sarvari via lists.openembedded.org wrote: > On 6/17/25 18:04, Steve Sakoman via lists.openembedded.org wrote: >> From: Savvas Etairidis <setairidis@gmail.com> >> >> The recipe was accidentally renamed with a 'v' >> prefix in 29e623b2ad00555788412fa520fbb9ffec794cbb. >> >> Signed-off-by: Savvas Etairidis <setairidis@gmail.com> >> Signed-off-by: Steve Sakoman <steve@sakoman.com> >> --- >> .../systemd/{systemd_v255.21.bb => systemd_255.21.bb} | 0 >> 1 file changed, 0 insertions(+), 0 deletions(-) >> rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%) >> > Personally I'm not affected by this issue, and have no problem with this > patch, but a few weeks ago there were people who were unhappy when a > similar issue popped up in Walnascar with autoconf (though it was caught > before merging), which makes me wonder if this is the way to go. > > Systemd already has a PE[1], exactly because of the same situation: "v" > was removed from the start of ${PV} - maybe it's time to bump. > > Anyway, as this patch does no harm to me, this is not a complaint > against it, but I thought it would be worth to mention it at least. > > [1]: > https://git.yoctoproject.org/poky/commit/?id=f95bbe35b2aab929e50471db8ba50781d5027a01 > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#218970): https://lists.openembedded.org/g/openembedded-core/message/218970 > Mute This Topic: https://lists.openembedded.org/mt/113692551/7304865 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [Qi.Chen@eng.windriver.com] > -=-=-=-=-=-=-=-=-=-=-=- >
On 6/18/25 09:24, ChenQi wrote: > The author's V1 patch bumped PE. > I replied to that patch, asking the author to not bump PE. > My reason is that we'll need to bump PE in later releases too > (walnascar, master) if we bump PE in scarthgap. My main question would be if bumping PE is worse than breaking this recipe in this release. Maybe it is - I just didn't see much discussions over this. > > Regards, > Qi > > On 6/18/25 15:08, Gyorgy Sarvari via lists.openembedded.org wrote: >> On 6/17/25 18:04, Steve Sakoman via lists.openembedded.org wrote: >>> From: Savvas Etairidis <setairidis@gmail.com> >>> >>> The recipe was accidentally renamed with a 'v' >>> prefix in 29e623b2ad00555788412fa520fbb9ffec794cbb. >>> >>> Signed-off-by: Savvas Etairidis <setairidis@gmail.com> >>> Signed-off-by: Steve Sakoman <steve@sakoman.com> >>> --- >>> .../systemd/{systemd_v255.21.bb => systemd_255.21.bb} | 0 >>> 1 file changed, 0 insertions(+), 0 deletions(-) >>> rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%) >>> >> Personally I'm not affected by this issue, and have no problem with this >> patch, but a few weeks ago there were people who were unhappy when a >> similar issue popped up in Walnascar with autoconf (though it was caught >> before merging), which makes me wonder if this is the way to go. >> >> Systemd already has a PE[1], exactly because of the same situation: "v" >> was removed from the start of ${PV} - maybe it's time to bump. >> >> Anyway, as this patch does no harm to me, this is not a complaint >> against it, but I thought it would be worth to mention it at least. >> >> [1]: >> https://git.yoctoproject.org/poky/commit/?id=f95bbe35b2aab929e50471db8ba50781d5027a01 >> >> >> -=-=-=-=-=-=-=-=-=-=-=- >> Links: You receive all messages sent to this group. >> View/Reply Online (#218970): https://lists.openembedded.org/g/openembedded-core/message/218970 >> Mute This Topic: https://lists.openembedded.org/mt/113692551/7304865 >> Group Owner: openembedded-core+owner@lists.openembedded.org >> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [Qi.Chen@eng.windriver.com] >> -=-=-=-=-=-=-=-=-=-=-=- >>
On 6/18/25 15:29, Gyorgy Sarvari wrote: > On 6/18/25 09:24, ChenQi wrote: >> The author's V1 patch bumped PE. >> I replied to that patch, asking the author to not bump PE. >> My reason is that we'll need to bump PE in later releases too >> (walnascar, master) if we bump PE in scarthgap. > My main question would be if bumping PE is worse than breaking this > recipe in this release. Maybe it is - I just didn't see much discussions > over this. Luckily, the commit that introduced this issue was not released yet. poky [2][0] $ git describe --contains 417cecf76b fatal: cannot describe '417cecf76b91f58a61e8cc9e4bc57ddda87aac58' poky [2][0] $ git log --oneline scarthgap-5.0.10..417cecf76b | wc -l 31 Regards, Qi > >> Regards, >> Qi >> >> On 6/18/25 15:08, Gyorgy Sarvari via lists.openembedded.org wrote: >>> On 6/17/25 18:04, Steve Sakoman via lists.openembedded.org wrote: >>>> From: Savvas Etairidis <setairidis@gmail.com> >>>> >>>> The recipe was accidentally renamed with a 'v' >>>> prefix in 29e623b2ad00555788412fa520fbb9ffec794cbb. >>>> >>>> Signed-off-by: Savvas Etairidis <setairidis@gmail.com> >>>> Signed-off-by: Steve Sakoman <steve@sakoman.com> >>>> --- >>>> .../systemd/{systemd_v255.21.bb => systemd_255.21.bb} | 0 >>>> 1 file changed, 0 insertions(+), 0 deletions(-) >>>> rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%) >>>> >>> Personally I'm not affected by this issue, and have no problem with this >>> patch, but a few weeks ago there were people who were unhappy when a >>> similar issue popped up in Walnascar with autoconf (though it was caught >>> before merging), which makes me wonder if this is the way to go. >>> >>> Systemd already has a PE[1], exactly because of the same situation: "v" >>> was removed from the start of ${PV} - maybe it's time to bump. >>> >>> Anyway, as this patch does no harm to me, this is not a complaint >>> against it, but I thought it would be worth to mention it at least. >>> >>> [1]: >>> https://git.yoctoproject.org/poky/commit/?id=f95bbe35b2aab929e50471db8ba50781d5027a01 >>> >>> >>> -=-=-=-=-=-=-=-=-=-=-=- >>> Links: You receive all messages sent to this group. >>> View/Reply Online (#218970): https://lists.openembedded.org/g/openembedded-core/message/218970 >>> Mute This Topic: https://lists.openembedded.org/mt/113692551/7304865 >>> Group Owner: openembedded-core+owner@lists.openembedded.org >>> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [Qi.Chen@eng.windriver.com] >>> -=-=-=-=-=-=-=-=-=-=-=- >>>
On 6/18/25 09:36, ChenQi wrote: > On 6/18/25 15:29, Gyorgy Sarvari wrote: >> On 6/18/25 09:24, ChenQi wrote: >>> The author's V1 patch bumped PE. >>> I replied to that patch, asking the author to not bump PE. >>> My reason is that we'll need to bump PE in later releases too >>> (walnascar, master) if we bump PE in scarthgap. >> My main question would be if bumping PE is worse than breaking this >> recipe in this release. Maybe it is - I just didn't see much discussions >> over this. > Luckily, the commit that introduced this issue was not released yet. > > poky [2][0] $ git describe --contains 417cecf76b > fatal: cannot describe '417cecf76b91f58a61e8cc9e4bc57ddda87aac58' > > poky [2][0] $ git log --oneline scarthgap-5.0.10..417cecf76b | wc -l > 31 Oh... indeed. I thought that this was tagged already long ago. Thanks for this, this does answer my concerns. > Regards, > Qi > >>> Regards, >>> Qi >>> >>> On 6/18/25 15:08, Gyorgy Sarvari via lists.openembedded.org wrote: >>>> On 6/17/25 18:04, Steve Sakoman via lists.openembedded.org wrote: >>>>> From: Savvas Etairidis <setairidis@gmail.com> >>>>> >>>>> The recipe was accidentally renamed with a 'v' >>>>> prefix in 29e623b2ad00555788412fa520fbb9ffec794cbb. >>>>> >>>>> Signed-off-by: Savvas Etairidis <setairidis@gmail.com> >>>>> Signed-off-by: Steve Sakoman <steve@sakoman.com> >>>>> --- >>>>> .../systemd/{systemd_v255.21.bb => systemd_255.21.bb} | 0 >>>>> 1 file changed, 0 insertions(+), 0 deletions(-) >>>>> rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%) >>>>> >>>> Personally I'm not affected by this issue, and have no problem with this >>>> patch, but a few weeks ago there were people who were unhappy when a >>>> similar issue popped up in Walnascar with autoconf (though it was caught >>>> before merging), which makes me wonder if this is the way to go. >>>> >>>> Systemd already has a PE[1], exactly because of the same situation: "v" >>>> was removed from the start of ${PV} - maybe it's time to bump. >>>> >>>> Anyway, as this patch does no harm to me, this is not a complaint >>>> against it, but I thought it would be worth to mention it at least. >>>> >>>> [1]: >>>> https://git.yoctoproject.org/poky/commit/?id=f95bbe35b2aab929e50471db8ba50781d5027a01 >>>> >>>> >>>> -=-=-=-=-=-=-=-=-=-=-=- >>>> Links: You receive all messages sent to this group. >>>> View/Reply Online (#218970): https://lists.openembedded.org/g/openembedded-core/message/218970 >>>> Mute This Topic: https://lists.openembedded.org/mt/113692551/7304865 >>>> Group Owner: openembedded-core+owner@lists.openembedded.org >>>> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [Qi.Chen@eng.windriver.com] >>>> -=-=-=-=-=-=-=-=-=-=-=- >>>>
It's not tagged, but it was merged to scarthgap branch 13 days ago as: https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=29e623b2ad00555788412fa520fbb9ffec794cbb We don't depend on package-manager upgrades, so version going backwards is not the real blocker for us, but PE bump in all active branches seems better fix than people not getting the next systemd upgrade (e.g. next systemd minor upgrade with security fixes) in projects which use package-manager on target and happened to build the package feed with this commit included (e.g. we don't wait for tagged "releases" from stable branches). Regards, On Wed, Jun 18, 2025 at 9:42 AM Gyorgy Sarvari via lists.openembedded.org <skandigraun=gmail.com@lists.openembedded.org> wrote: > > On 6/18/25 09:36, ChenQi wrote: > > On 6/18/25 15:29, Gyorgy Sarvari wrote: > >> On 6/18/25 09:24, ChenQi wrote: > >>> The author's V1 patch bumped PE. > >>> I replied to that patch, asking the author to not bump PE. > >>> My reason is that we'll need to bump PE in later releases too > >>> (walnascar, master) if we bump PE in scarthgap. > >> My main question would be if bumping PE is worse than breaking this > >> recipe in this release. Maybe it is - I just didn't see much discussions > >> over this. > > Luckily, the commit that introduced this issue was not released yet. > > > > poky [2][0] $ git describe --contains 417cecf76b > > fatal: cannot describe '417cecf76b91f58a61e8cc9e4bc57ddda87aac58' > > > > poky [2][0] $ git log --oneline scarthgap-5.0.10..417cecf76b | wc -l > > 31 > > Oh... indeed. I thought that this was tagged already long ago. Thanks > for this, this does answer my concerns. > > > Regards, > > Qi > > > >>> Regards, > >>> Qi > >>> > >>> On 6/18/25 15:08, Gyorgy Sarvari via lists.openembedded.org wrote: > >>>> On 6/17/25 18:04, Steve Sakoman via lists.openembedded.org wrote: > >>>>> From: Savvas Etairidis <setairidis@gmail.com> > >>>>> > >>>>> The recipe was accidentally renamed with a 'v' > >>>>> prefix in 29e623b2ad00555788412fa520fbb9ffec794cbb. > >>>>> > >>>>> Signed-off-by: Savvas Etairidis <setairidis@gmail.com> > >>>>> Signed-off-by: Steve Sakoman <steve@sakoman.com> > >>>>> --- > >>>>> .../systemd/{systemd_v255.21.bb => systemd_255.21.bb} | 0 > >>>>> 1 file changed, 0 insertions(+), 0 deletions(-) > >>>>> rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%) > >>>>> > >>>> Personally I'm not affected by this issue, and have no problem with this > >>>> patch, but a few weeks ago there were people who were unhappy when a > >>>> similar issue popped up in Walnascar with autoconf (though it was caught > >>>> before merging), which makes me wonder if this is the way to go. > >>>> > >>>> Systemd already has a PE[1], exactly because of the same situation: "v" > >>>> was removed from the start of ${PV} - maybe it's time to bump. > >>>> > >>>> Anyway, as this patch does no harm to me, this is not a complaint > >>>> against it, but I thought it would be worth to mention it at least. > >>>> > >>>> [1]: > >>>> https://git.yoctoproject.org/poky/commit/?id=f95bbe35b2aab929e50471db8ba50781d5027a01 > >>>> > >>>> > >>>> > >>>> > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#218975): https://lists.openembedded.org/g/openembedded-core/message/218975 > Mute This Topic: https://lists.openembedded.org/mt/113692551/3617156 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [martin.jansa@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- >
This is a possible scenario, but it is theoretical and not likely at this point. And if someone is affected by this, then they can find a way to force a downgrade with the package manager, or maintain the bogus version with a bbappend, or issue a whole-image update. I'd rather not force a PE bump on everybody, including the master oe-core branch. Alex On Wed, 18 Jun 2025 at 09:53, Martin Jansa via lists.openembedded.org <martin.jansa=gmail.com@lists.openembedded.org> wrote: > > It's not tagged, but it was merged to scarthgap branch 13 days ago as: > https://git.openembedded.org/openembedded-core/commit/?h=scarthgap&id=29e623b2ad00555788412fa520fbb9ffec794cbb > > We don't depend on package-manager upgrades, so version going > backwards is not the real blocker for us, but PE bump in all active > branches seems better fix than people not getting the next systemd > upgrade (e.g. next systemd minor upgrade with security fixes) in > projects which use package-manager on target and happened to build the > package feed with this commit included (e.g. we don't wait for tagged > "releases" from stable branches). > > Regards, > > On Wed, Jun 18, 2025 at 9:42 AM Gyorgy Sarvari via > lists.openembedded.org <skandigraun=gmail.com@lists.openembedded.org> > wrote: > > > > On 6/18/25 09:36, ChenQi wrote: > > > On 6/18/25 15:29, Gyorgy Sarvari wrote: > > >> On 6/18/25 09:24, ChenQi wrote: > > >>> The author's V1 patch bumped PE. > > >>> I replied to that patch, asking the author to not bump PE. > > >>> My reason is that we'll need to bump PE in later releases too > > >>> (walnascar, master) if we bump PE in scarthgap. > > >> My main question would be if bumping PE is worse than breaking this > > >> recipe in this release. Maybe it is - I just didn't see much discussions > > >> over this. > > > Luckily, the commit that introduced this issue was not released yet. > > > > > > poky [2][0] $ git describe --contains 417cecf76b > > > fatal: cannot describe '417cecf76b91f58a61e8cc9e4bc57ddda87aac58' > > > > > > poky [2][0] $ git log --oneline scarthgap-5.0.10..417cecf76b | wc -l > > > 31 > > > > Oh... indeed. I thought that this was tagged already long ago. Thanks > > for this, this does answer my concerns. > > > > > Regards, > > > Qi > > > > > >>> Regards, > > >>> Qi > > >>> > > >>> On 6/18/25 15:08, Gyorgy Sarvari via lists.openembedded.org wrote: > > >>>> On 6/17/25 18:04, Steve Sakoman via lists.openembedded.org wrote: > > >>>>> From: Savvas Etairidis <setairidis@gmail.com> > > >>>>> > > >>>>> The recipe was accidentally renamed with a 'v' > > >>>>> prefix in 29e623b2ad00555788412fa520fbb9ffec794cbb. > > >>>>> > > >>>>> Signed-off-by: Savvas Etairidis <setairidis@gmail.com> > > >>>>> Signed-off-by: Steve Sakoman <steve@sakoman.com> > > >>>>> --- > > >>>>> .../systemd/{systemd_v255.21.bb => systemd_255.21.bb} | 0 > > >>>>> 1 file changed, 0 insertions(+), 0 deletions(-) > > >>>>> rename meta/recipes-core/systemd/{systemd_v255.21.bb => systemd_255.21.bb} (100%) > > >>>>> > > >>>> Personally I'm not affected by this issue, and have no problem with this > > >>>> patch, but a few weeks ago there were people who were unhappy when a > > >>>> similar issue popped up in Walnascar with autoconf (though it was caught > > >>>> before merging), which makes me wonder if this is the way to go. > > >>>> > > >>>> Systemd already has a PE[1], exactly because of the same situation: "v" > > >>>> was removed from the start of ${PV} - maybe it's time to bump. > > >>>> > > >>>> Anyway, as this patch does no harm to me, this is not a complaint > > >>>> against it, but I thought it would be worth to mention it at least. > > >>>> > > >>>> [1]: > > >>>> https://git.yoctoproject.org/poky/commit/?id=f95bbe35b2aab929e50471db8ba50781d5027a01 > > >>>> > > >>>> > > >>>> > > >>>> > > > > > > > > > > -=-=-=-=-=-=-=-=-=-=-=- > Links: You receive all messages sent to this group. > View/Reply Online (#218977): https://lists.openembedded.org/g/openembedded-core/message/218977 > Mute This Topic: https://lists.openembedded.org/mt/113692551/1686489 > Group Owner: openembedded-core+owner@lists.openembedded.org > Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [alex.kanavin@gmail.com] > -=-=-=-=-=-=-=-=-=-=-=- >
diff --git a/meta/recipes-core/systemd/systemd_v255.21.bb b/meta/recipes-core/systemd/systemd_255.21.bb
similarity index 100%
rename from meta/recipes-core/systemd/systemd_v255.21.bb
rename to meta/recipes-core/systemd/systemd_255.21.bb