These are recipes where the upstream has moved to GPLv3 and these old
versions are the last ones under the GPLv2 license.
There are several reasons for making this move. There is a different
quality of service with these recipes in that they don't get security
fixes and upstream no longer care about them, in fact they're actively
hostile against people using old versions. The recipes tend to need a
different kind of maintenance to work with changes in the wider ecosystem
and there needs to be isolation between changes made in the v3 versions
and those in the v2 versions.
There are probably better ways to handle a "non-GPLv3" system but right
now having these in OE-Core makes them look like a first class citizen
when I believe they have potential for a variety of undesireable issues.
Moving them into a separate layer makes their different needs clearer, it
also makes it clear how many of these there are. Some are probably not
needed (e.g. mc), I also wonder whether some are useful (e.g. gmp)
since most things that use them are GPLv3 only already. Someone could
now more clearly see how to streamline the list of recipes here.
I'm proposing we mmove to this separate layer for 2.3 with its future
maintinership and testing to be determined in 2.4 and beyond.
(From OE-Core rev: 19b7e950346fb1dde6505c45236eba6cd9b33b4b)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Update LIC_FILES_CHKSUM md5 checksum, because "http" has been
changed to "https".
(From OE-Core rev: ec672ab878ca203385b3fbd764c17af6b56d8475)
Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
https version seems more reliable and in an informal test fetching
all gnupg recipes now takes <20% of the time it used to.
Define GNUPG_MIRROR in bitbake.conf so future tweaks to this are
easier. Replace some slower mirrors with the official ftp site
and another from gnupg.org mirror list.
Set UPSTREAM_CHECK_URI in all recipes that need it to
"https://gnupg.org/download/index.html" as the directory listings
are not up-to-date.
(From OE-Core rev: dfc9178e2f2b6873ca497d981e308e00d15280b5)
Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The currnet patches in OE-core doesn't have the "CVE:"
tag, now part of the policy of the patches.
This is patch add this tag to several patches. There might
be patches that I miss; the tag can be added in the future.
(From OE-Core rev: 065ebeb3e15311d0d45385e15bf557b1c95b1669)
Signed-off-by: Mariano Lopez <mariano.lopez@linux.intel.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
With the autodebug package generation logic, specifically setting FILES_${PN}-dbg
isn't needed in most cases, we can remove them.
(From OE-Core rev: 3ab59d49dd7c18e194b58d1248b4b87709b5a738)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
find-version always assumes that gnupg is beta if autogen.sh is run
out of git-repo. This doesn't work for users whom just take release
tarball and re-run autoconf in their local build dir.
This fixes runtime issue:
$gpg --list-sigs
gpg: NOTE: THIS IS A DEVELOPMENT VERSION!
gpg: It is only intended for test purposes and should NOT be
gpg: used in a production environment or with production keys!
(From OE-Core rev: a37cccca3bb3bad0d8d7e375fb7e3cc339ac8250)
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Fix a variety of problems such as typos, bad punctuations, or incorrect
Upstream-Status values.
(From OE-Core rev: bd220fe6ce8c3a0805f13a14706d3130ea872604)
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 78b159bf753c43c78bb0f283add7d447b96e08f1)
(From OE-Core rev: 1054d5c0c0353b2ae89ab70232055eec759ccd43)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: ff816147ebb2cd07fde55ecd0d6520f1ffa347fa)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Force gcc's traditional handling of inline to avoid issues with gcc 5.
Upstream gnupg has a more specific fix, however it was made after
gnupg was relicensed to GPLv3 so may be unsafe to backport directly.
http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=5093bed27580e608de073bcc5953bd76b6b8b2de
(From OE-Core rev: c9883a572eb92e9b846e9021495e0715fb2a4db7)
Signed-off-by: Andre McCurdy <armccurdy@gmail.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: 742e0fa636d4792d1fad088bed3c194fb4374e91)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Updated dirmngr-uses-libgpg-error.patch.
(From OE-Core rev: 9c5cb4e2b51e605523d636f57d071593a01014ee)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
(From OE-Core rev: bd24517116455492abbc429196e5c9db4c1be1c7)
Signed-off-by: Robert Yang <liezhi.yang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Add patch to use pkg-config instead of npth-config and remove
--without-curl as it's not used anymore.
Also needed a patch to add libgpg-error to correctly build dirmngr
(From OE-Core rev: 0509f3b6f880b516dfbe053b13d417f724509b99)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
If build gnupg 1.4.7 after libusb-compat, it shows warning:
WARNING: QA Issue: gnupg rdepends on libusb-compat, but it isn't a build dependency? [build-deps]
Add package config libusb to fix it.
(From OE-Core rev: e1c77392143e538a2305f63ee3add611ec66e877)
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GnuPG before 1.4.14, and Libgcrypt before 1.5.3 as used in GnuPG 2.0.x
and possibly other products, allows local users to obtain private RSA
keys via a cache side-channel attack involving the L3 cache, aka
Flush+Reload.
Patch from commit e2202ff2b704623efc6277fb5256e4e15bac5676 in
git://git.gnupg.org/libgcrypt.git
(From OE-Core rev: d1e0f3e71ce9978ff0fc94d71e67b528dad84c5c)
Signed-off-by: Yong Zhang <yong.zhang@windriver.com>
Signed-off-by: Kai Kang <kai.kang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Pinentry is needed for most function of GnuPG, so add it into RRECOMMENDS
(From OE-Core rev: dc274b6325cfc6b78d51c97445b1af445ccfed93)
Signed-off-by: Roy Li <rongqing.li@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
gnupg can be built with or without curl. This should be explicitly defined
to avoid race between curl and gnupg.
(From OE-Core rev: 4e5f6f95e8e791c9cfc9e3bd91f1018d83ab252f)
Signed-off-by: Mikhail Durnev <mikhail_durnev@mentor.com>
Signed-off-by: Shrikant Bobade <Shrikant_Bobade@mentor.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
These recipes all use pkg-config in some way but were missing
dependencies on the tool, this patch adds them.
(From OE-Core rev: 2543b14dd0ca13005be0df027543431fc8e882ae)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Use pkg-config to find pth instead of pth-config and our own macros from
aclocal-copy.
(From OE-Core rev: 437ad15de308769c9251a37ed41dabed5653fc96)
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The class itself currently does nothing. The idea is to mark all recipes that
make use of the texinfo utilities. In the future, this class could be used to
suppress the generation/formatting of documentation for performance,
explicitly track dependencies on these utilities, and eliminate Yocto's
current dependency on the host system's texinfo utilities.
(From OE-Core rev: e6fb2f9afe2ba6b676c46d1eb297ca9cc532d405)
Signed-off-by: Max Eliaser <max.eliaser@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GnuPG 1.x before 1.4.16 generates RSA keys using sequences of introductions
with certain patterns that introduce a side channel, which allows physically
proximate attackers to extract RSA keys via a chosen-ciphertext attack and
acoustic cryptanalysis during decryption. NOTE: applications are not typically
expected to protect themselves from acoustic side-channel attacks, since this
is arguably the responsibility of the physical device. Accordingly, issues of
this type would not normally receive a CVE identifier. However, for this
issue, the developer has specified a security policy in which GnuPG should
offer side-channel resistance, and developer-specified security-policy
violations are within the scope of CVE.
(From OE-Core rev: 46b80c80b0e008820b34f4360054e1697df2650d)
Signed-off-by: Yong Zhang <yong.zhang@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits
cleared (no usage permitted) as if it has all bits set (all usage permitted),
which might allow remote attackers to bypass intended cryptographic protection
mechanisms by leveraging the subkey.
(From OE-Core rev: 259aebc9dbcaeb1587aaaab849942f55fa321724)
Signed-off-by: Ming Liu <ming.liu@windriver.com>
Signed-off-by: Jackie Huang <jackie.huang@windriver.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
A lot of our recipes had short one-line DESCRIPTION values and no
SUMMARY value set. In this case it's much better to just set SUMMARY
since DESCRIPTION is defaulted from SUMMARY anyway and then the SUMMARY
is at least useful. I also took the opportunity to fix up a lot of the
new SUMMARY values, making them concisely explain the function of the
recipe / package where possible.
(From OE-Core rev: b8feee3cf21f70ba4ec3b822d2f596d4fc02a292)
Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Gnupg 2.0.19 installs 'gpgv2' but apt-get and possibly other utilities expect
to find this as 'gpgv'. A symlink is created in the same way as the link for
'gpg'.
(From OE-Core rev: 32f3596cefc034398803032785714b289766bb66)
Signed-off-by: Paul Barker <paul@paulbarker.me.uk>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
gnupg has it's own fake curl, since we use gnupg with zypper, there does not
seem to be a strong reason to add curl to the depends list.
(From OE-Core rev: 44ea2cf548ca20488449d347f8f3b7d49f7e7493)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
The CCID driver driver is apparently unnecessary, so disable it.
Also remove the associated libusb dependency, since that won't be
needed either.
According to Scott Garman <scott.a.garman@intel.com>:
I'd just note that the CCID smartcard reader is a specific piece of
hardware that is unlikely to be used in a majority of our use cases.
(From OE-Core rev: 18be6fbde8fc9a6546ee865a4c43bd1eafa81a3c)
Signed-off-by: Tom Zanussi <tom.zanussi@intel.com>
Signed-off-by: Elizabeth Flanagan <elizabeth.flanagan@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
gnupg apparently depends on libusb:
| error: Failed dependencies:
| libusb-0.1-4 >= 0.1.3 is needed by gnupg-2.0.18-r1.core2
So add libusb to gnupg DEPENDS.
(From OE-Core rev: fd79e09c90e51a8f454f0fdd837c5141b9eadbde)
Signed-off-by: Tom Zanussi <tom.zanussi@intel.com>
Signed-off-by: Elizabeth Flanagan <elizabeth.flanagan@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
* Create libbz2 (and -dev, -staticdev), which can be
installed without the bzip2 executables.
(From OE-Core rev: e27af1f273e9a7348dd8f5542df9206acd9210f3)
Signed-off-by: Andreas Oberritter <obi@opendreambox.org>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Seems the wrong commit was grabbed and missed this patch
(From OE-Core rev: 347426ca3dbe06df1d1b0976a81e96cf6238af21)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This recipe was added, but did not have the correct
checksum information for the LIC_FILES_CHKSUM or the
SRC_URI. Also disable Documetnation for now due to
older autotools issue.
[YOCTO #1966]
(From OE-Core rev: e8c02ead5ce130492eb11457f58cc4d28a330132)
Signed-off-by: Saul Wold <sgw@linux.intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Found during single recipe rebuilds
(From OE-Core rev: bb672b1591197966b79fbcf7753f995b8e829e65)
Signed-off-by: Khem Raj <raj.khem@gmail.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
GnuPG 2.0 is the new modularized version of GnuPG supporting OpenPGP and S/MIME
(From OE-Core rev: d99215fb1928e9996bb358b9f95d379d93b45377)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Acked-by: Paul Menzel <paulepanter@users.sourceforge.net>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Richard Purdie
Hongxu Jia
Jussi Kukkonen
Alexander Kanavin
Mariano Lopez
Wenzong Fan
Ross Burton
Robert Yang
Andre McCurdy
Saul Wold
Kai Kang
Roy Li
Shrikant Bobade
Max Eliaser
Yong Zhang
Ming Liu
Paul Eggleton
Paul Barker
Jackie Huang
Khem Raj
Tom Zanussi
Laurentiu Palcu
Andreas Oberritter
Zhai Edwin
Steve Sakoman