mbox

[scarthgap,00/13] Patch review

Message ID cover.1789163914.git.yoann.congal@smile.fr
State Not Applicable, archived
Headers show

Pull-request

https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut

Message

Yoann Congal Sept. 11, 2026, 10:14 p.m. UTC 
Please review this set of changes for scarthgap and have comments back by
end of day Tuesday, September 15.

Passed a-full on autobuilder:
https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4718
* oe-selftest-fedora fails with 16415 – AB-INT: github infrastructure issues
  I still need to backport fixes from master to wrynose, and then,
  scarthgap.
* qemuarm64-ptest failed with 16267 – [scarthgap] AB-INT PTEST: python3 failure (test_wrong_cert_tls13)
  retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4516
Note: this build was not rebased on the latest build-appliance update.


The following changes since commit bb166ac536daa43602ce8962cd3eb137783b8dc9:

  build-appliance-image: Update to scarthgap head revision (2026-09-11 14:32:15 +0100)

are available in the Git repository at:

  https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
  https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut

for you to fetch changes up to e85367ebf673225c69694ee63679ea7620c4b420:

  u-boot, u-boot-tools: Fix CVE-2026-46728 (2026-09-11 17:32:37 +0200)

----------------------------------------------------------------

Daniel Turull (1):
  libarchive: mark CVE-2026-14164 as fixed-version

Darsh Kelaiya (1):
  python3-lxml: fix CVE-2026-41066

Deepak Rathore (2):
  binutils: fix CVE-2026-3441 and CVE-2026-3442
  binutils: fix CVE-2026-4647

Devansh Patel (1):
  u-boot: share CVE_PRODUCT with u-boot-tools

Gyorgy Sarvari (1):
  python3-py: set CVE_PRODUCT

Hetvi Thakar (4):
  python3-pip: Fix CVE-2026-8643
  go: Fix CVE-2026-33814
  go: Fix CVE-2026-39823
  u-boot, u-boot-tools: Fix CVE-2026-46728

Peter Marko (1):
  openssl: upgrade 3.5.7 -> 3.5.8

Vijay Anusuri (1):
  p11-kit: Fix CVE-2026-18938

Yoann Congal (1):
  linux-yocto/6.6: update CVE exclusions (6.6.151)

 .../u-boot/files/CVE-2026-46728.patch         |  379 ++
 meta/recipes-bsp/u-boot/u-boot-common.inc     |    2 +
 .../u-boot/u-boot-tools_2024.01.bb            |    2 +
 meta/recipes-bsp/u-boot/u-boot.inc            |    2 -
 meta/recipes-bsp/u-boot/u-boot_2024.01.bb     |    1 +
 .../{openssl_3.5.7.bb => openssl_3.5.8.bb}    |    2 +-
 .../binutils/binutils-2.42.inc                |    2 +
 .../CVE-2026-3441_CVE-2026-3442.patch         |   51 +
 .../binutils/binutils/CVE-2026-4647.patch     |  228 +
 meta/recipes-devtools/go/go-1.22.12.inc       |    2 +
 .../go/go/CVE-2026-33814.patch                |   44 +
 .../go/go/CVE-2026-39823.patch                |  100 +
 .../python/python3-lxml/CVE-2026-41066.patch  |  262 +
 .../python/python3-lxml_5.0.2.bb              |    4 +-
 .../CVE-2026-8643-regression_p1.patch         |   34 +
 .../CVE-2026-8643-regression_p2.patch         |   69 +
 .../python/python3-pip/CVE-2026-8643.patch    |   79 +
 .../python/python3-pip_24.0.bb                |    3 +
 .../python/python3-py_1.11.0.bb               |    2 +
 .../libarchive/libarchive_3.7.9.bb            |    5 +
 .../linux/cve-exclusion_6.6.inc               | 4540 ++++++++++++++++-
 .../p11-kit/files/CVE-2026-18938.patch        |   52 +
 .../recipes-support/p11-kit/p11-kit_0.25.3.bb |    1 +
 23 files changed, 5787 insertions(+), 79 deletions(-)
 create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
 rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_3.5.8.bb} (99%)
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
 create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch
 create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch
 create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch
 create mode 100644 meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch
 create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p1.patch
 create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p2.patch
 create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch
 create mode 100644 meta/recipes-support/p11-kit/files/CVE-2026-18938.patch

Comments

Ankur Tyagi Sept. 13, 2026, 12:12 a.m. UTC | #1 
Hello Yoann,

Any reason why the following were not included?

https://lists.openembedded.org/g/openembedded-core/message/245310
https://lists.openembedded.org/g/openembedded-core/message/245311

cheers
Ankur

On Sat, Sep 12, 2026 at 10:15 AM Yoann Congal via
lists.openembedded.org <yoann.congal=smile.fr@lists.openembedded.org>
wrote:
>
> Please review this set of changes for scarthgap and have comments back by
> end of day Tuesday, September 15.
>
> Passed a-full on autobuilder:
> https://autobuilder.yoctoproject.org/valkyrie/?#/builders/29/builds/4718
> * oe-selftest-fedora fails with 16415 – AB-INT: github infrastructure issues
>   I still need to backport fixes from master to wrynose, and then,
>   scarthgap.
> * qemuarm64-ptest failed with 16267 – [scarthgap] AB-INT PTEST: python3 failure (test_wrong_cert_tls13)
>   retried in https://autobuilder.yoctoproject.org/valkyrie/?#/builders/61/builds/4516
> Note: this build was not rebased on the latest build-appliance update.
>
>
> The following changes since commit bb166ac536daa43602ce8962cd3eb137783b8dc9:
>
>   build-appliance-image: Update to scarthgap head revision (2026-09-11 14:32:15 +0100)
>
> are available in the Git repository at:
>
>   https://git.openembedded.org/openembedded-core-contrib stable/scarthgap-nut
>   https://git.openembedded.org/openembedded-core-contrib/log/?h=stable/scarthgap-nut
>
> for you to fetch changes up to e85367ebf673225c69694ee63679ea7620c4b420:
>
>   u-boot, u-boot-tools: Fix CVE-2026-46728 (2026-09-11 17:32:37 +0200)
>
> ----------------------------------------------------------------
>
> Daniel Turull (1):
>   libarchive: mark CVE-2026-14164 as fixed-version
>
> Darsh Kelaiya (1):
>   python3-lxml: fix CVE-2026-41066
>
> Deepak Rathore (2):
>   binutils: fix CVE-2026-3441 and CVE-2026-3442
>   binutils: fix CVE-2026-4647
>
> Devansh Patel (1):
>   u-boot: share CVE_PRODUCT with u-boot-tools
>
> Gyorgy Sarvari (1):
>   python3-py: set CVE_PRODUCT
>
> Hetvi Thakar (4):
>   python3-pip: Fix CVE-2026-8643
>   go: Fix CVE-2026-33814
>   go: Fix CVE-2026-39823
>   u-boot, u-boot-tools: Fix CVE-2026-46728
>
> Peter Marko (1):
>   openssl: upgrade 3.5.7 -> 3.5.8
>
> Vijay Anusuri (1):
>   p11-kit: Fix CVE-2026-18938
>
> Yoann Congal (1):
>   linux-yocto/6.6: update CVE exclusions (6.6.151)
>
>  .../u-boot/files/CVE-2026-46728.patch         |  379 ++
>  meta/recipes-bsp/u-boot/u-boot-common.inc     |    2 +
>  .../u-boot/u-boot-tools_2024.01.bb            |    2 +
>  meta/recipes-bsp/u-boot/u-boot.inc            |    2 -
>  meta/recipes-bsp/u-boot/u-boot_2024.01.bb     |    1 +
>  .../{openssl_3.5.7.bb => openssl_3.5.8.bb}    |    2 +-
>  .../binutils/binutils-2.42.inc                |    2 +
>  .../CVE-2026-3441_CVE-2026-3442.patch         |   51 +
>  .../binutils/binutils/CVE-2026-4647.patch     |  228 +
>  meta/recipes-devtools/go/go-1.22.12.inc       |    2 +
>  .../go/go/CVE-2026-33814.patch                |   44 +
>  .../go/go/CVE-2026-39823.patch                |  100 +
>  .../python/python3-lxml/CVE-2026-41066.patch  |  262 +
>  .../python/python3-lxml_5.0.2.bb              |    4 +-
>  .../CVE-2026-8643-regression_p1.patch         |   34 +
>  .../CVE-2026-8643-regression_p2.patch         |   69 +
>  .../python/python3-pip/CVE-2026-8643.patch    |   79 +
>  .../python/python3-pip_24.0.bb                |    3 +
>  .../python/python3-py_1.11.0.bb               |    2 +
>  .../libarchive/libarchive_3.7.9.bb            |    5 +
>  .../linux/cve-exclusion_6.6.inc               | 4540 ++++++++++++++++-
>  .../p11-kit/files/CVE-2026-18938.patch        |   52 +
>  .../recipes-support/p11-kit/p11-kit_0.25.3.bb |    1 +
>  23 files changed, 5787 insertions(+), 79 deletions(-)
>  create mode 100644 meta/recipes-bsp/u-boot/files/CVE-2026-46728.patch
>  rename meta/recipes-connectivity/openssl/{openssl_3.5.7.bb => openssl_3.5.8.bb} (99%)
>  create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-3441_CVE-2026-3442.patch
>  create mode 100644 meta/recipes-devtools/binutils/binutils/CVE-2026-4647.patch
>  create mode 100644 meta/recipes-devtools/go/go/CVE-2026-33814.patch
>  create mode 100644 meta/recipes-devtools/go/go/CVE-2026-39823.patch
>  create mode 100644 meta/recipes-devtools/python/python3-lxml/CVE-2026-41066.patch
>  create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p1.patch
>  create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643-regression_p2.patch
>  create mode 100644 meta/recipes-devtools/python/python3-pip/CVE-2026-8643.patch
>  create mode 100644 meta/recipes-support/p11-kit/files/CVE-2026-18938.patch
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#245670): https://lists.openembedded.org/g/openembedded-core/message/245670
> Mute This Topic: https://lists.openembedded.org/mt/121207001/3619737
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [ankur.tyagi85@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
Yoann Congal Sept. 13, 2026, 2:22 p.m. UTC | #2 
Le dim. 13 sept. 2026, 02:12, Ankur Tyagi <ankur.tyagi85@gmail.com> a
écrit :

> Hello Yoann,
>
> Any reason why the following were not included?
>
> https://lists.openembedded.org/g/openembedded-core/message/245310
> https://lists.openembedded.org/g/openembedded-core/message/245311


Hello,

Yes, the reason being that I need to merge those to wrynose first.

These should go in the next review cycle (this week).

Thanks!

>
Ankur Tyagi Sept. 14, 2026, 2:18 a.m. UTC | #3 
On Mon, Sep 14, 2026 at 2:23 AM Yoann Congal <yoann.congal@smile.fr> wrote:
>
> Le dim. 13 sept. 2026, 02:12, Ankur Tyagi <ankur.tyagi85@gmail.com> a écrit :
>>
>> Hello Yoann,
>>
>> Any reason why the following were not included?
>>
>> https://lists.openembedded.org/g/openembedded-core/message/245310
>> https://lists.openembedded.org/g/openembedded-core/message/245311
>
>
> Hello,
>
> Yes, the reason being that I need to merge those to wrynose first.
>
> These should go in the next review cycle (this week).

Understood, thanks.

>
> Thanks!