diff mbox series

[10/20] barebox-tools: upgrade 2026.08.0 -> 2026.09.0

Message ID 20260921070656.521680-10-richard.purdie@linuxfoundation.org
State New
Headers show
Series [01/20] ffmpeg: upgrade 9.0.1 -> 9.0.2 | expand

Commit Message

Richard Purdie Sept. 21, 2026, 7:06 a.m. UTC 
"""
This release fixes vulnerabilities in the FIT image code. Most important
one is fixed with "FIT: resolve FIT images case-sensitively". This
vulnerability allowed to trick barebox into verifying one FIT image node
while booting another. The issue showed up in a security audit and is
fixed in this release, stable updates for v2026.04 and v2026.08 will
follow shortly.

Another issue fixed is that a hash node in a FIT image defines its
algorithm. We used to look only at the first hash node. If that says
crc32 then barebox would use that to verify the image data. This is
changed to iterate over the available algos from strong to weak and
see if one of them can verify the image data. crc32, md5 and sha1 are
explicitly no longer allowed. Note that this vulnerability requires
a signed FIT image with crc32 as hashing algorithm, something a properly
signed FIT image shouldn't have, but as crc32 used to be the
pre-secure-boot standard, it could well have leaked into images.

On the brighter side this release adds support for the Novarq Tactical
1000 board which is a switch built around the Microchip LAN9696. Also
the PXA support has been revived, with the PXA3xx as a fully supported
device tree platform.
"""

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
---
 meta/recipes-bsp/barebox/barebox-common.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/meta/recipes-bsp/barebox/barebox-common.inc b/meta/recipes-bsp/barebox/barebox-common.inc
index a9f0593e27f..d94798193b3 100644
--- a/meta/recipes-bsp/barebox/barebox-common.inc
+++ b/meta/recipes-bsp/barebox/barebox-common.inc
@@ -3,6 +3,6 @@  SECTION = "bootloaders"
 
 LIC_FILES_CHKSUM = "file://COPYING;md5=f5125d13e000b9ca1f0d3364286c4192"
 
-PV = "2026.08.0"
+PV = "2026.09.0"
 SRC_URI = "https://barebox.org/download/barebox-${PV}.tar.bz2"
-SRC_URI[sha256sum] = "5b270cbde7f2fc6a78ff6e748eef788bbc04571682e2f2e964cd15a2e009774c"
+SRC_URI[sha256sum] = "491b504c8a79b5a4e30c419b824916b7329bad8abfe34987ba066bafa1fbcfc5"