On v3.2.2, testing with an Infineon SLB9673 resulted in the following
error when attempting to read from a previously written NV index.
Upgrading to the latest release, v4.1.3, resolves the issue:
```shell
~# tpm2_nvread 0x1900001
WARN: Reading full size of the NV index
ERROR:esys:../tpm2-tss-3.2.2/src/tss2-esys/esys_iutil.c:1096:esys_GetResourceObject() Error: Esys handle does not exist (70018).
ERROR: Esys_SequenceComplete(0x70018) - esapi:The ESYS_TR resource object is bad
ERROR: Failed to get shandle
ERROR: Failed to read NVRAM area at index 0x1900001
ERROR: Unable to run tpm2_nvread
```
Between v3.2.2 and v4.1.3, the most notable update is v4.1.0 [1], which
includes a fix for CVE-2024-29040, along with 40+ bug fixes and 10+ new
features. Bumping to v4.1.3 adds access to these improvements and
addresses the NV index read issue.
[1] https://github.com/tpm2-software/tpm2-tss/releases/tag/4.1.0
Fixes:
https://www.cve.org/CVERecord?id=CVE-2024-29040
Signed-off-by: Abelino Romo <abelino.romo@gmail.com>
[Fiona: rebase for package/tpm2-tss changes]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Julien:
- add "security" in commit log title
- add "Fixes:" and CVE url in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The commit [1] set the default value of '<pkg>_CPE_ID_UPDATE' to not use
a wildcard by default. But instead of setting the value to '-' it set it
to an empty value instead.
According to document [2] section 6.1.2.1.1 the 'Not Attributed' value
bind to an hyphen ('-') and the blank statement bind to the 'Any' ('*').
Because the CPE matching function was incorrect using a blank statement
worked to remove the false positives but this is not correct according
to the CPE documentation.
[1] 53a8616460 package/pkg-generic.mk: use more sensible default value for <pkg>_CPE_ID_UPDATE
[2] https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf
Fixes: 53a8616460.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Given the following criteria: `cpe:2.3:a:oneidentitty:syslog-ng:*:*:*:*:-:*:*:*`.
The former `cpe_matches` implementation would match with the following
CPE: `cpe:2.3:a:oneidentitty:syslog-ng:4.71:*:*:*:premium:*:*:*`.
The 'hyphen' ('-') meaning is "Not Attributed" (NA) a criteria with no
attributed software edition shouldn't match with a CPE with an attributed
software edition:
https://csrc.nist.gov/pubs/ir/7695/final
This patch also create a distinct 'CPE' object that aggregate the
function specifics to CPEs like it's done for 'CVE'.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The `support/script/cve.py` file is used as a library. Depending on how
you use this library you might not want to write content to stdout when
calling its function.
This patch move the 'updating' log to the 'pkg-stats' script and write
the alert when LooseVersion doesn't have a version to stderr.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since Buildroot commit [1] "package/llvm-project: bump to version
21.1.4", bcc is failing at compilation time.
This commit adds an upstream patch to fix this issue.
[1] d6a7c02263
Signed-off-by: Julien Olivain <ju.o@free.fr>
The test tests.package.test_xen.TestXenArmv7 has become unstable after
commit 24ff258905 ("support/testing: test_xen: add networking"),
leading to a ~50% chance of failure on gitlab CI.
This seems to happen only with 32b (not with the 64b TestXenAarch64),
only with Qemu < 9.1, and when this happens the test will hang during a
step involving the simulated network and the dom1 (DHCP or ping).
The root cause is suspected to be a bug in the virtio-net hardware
emulation of the qemu version 7.2.15 included in the Buildroot docker
image.
As a workaround, remove all network interactions between dom1 and the
simulated network:
- Instead of the gateway, ping dom0 from dom1.
- Instead of using DHCP, configure the network with fixed IP addresses,
so that we know the IP address of the dom0.
A possible solution could have been to compile a host-qemu within the
test, by adding BR2_PACKAGE_HOST_QEMU=y and
BR2_PACKAGE_HOST_QEMU_SYSTEM_MODE=y in the test configuration.
This would have used the current Buildroot version (10.1.0) not affected
by this issue, but this would also have significantly increased the test
compilation time.
Since the DHCP is not really needed here to test the Xen networking
capability, this is why the network configuration simplification was
preferred here.
After those changes both Xen tests are stable on CI and locally.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/11871454648
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- The mkeficapsule tools need gnutls to build, and the config dependency
to build the tool has changed
- CONFIG_FIT_SIGNATURE need to be defined to build fit_check_sign
- CONFIG_FIT_PRINT does not need to be defined anymore
- Remove patch 2 and reorder patch files
- Include linux/kconfig.h to include/config.h to allow IS_ENABLED macro
to be used in c files
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Julien: update .checkpackageignore to fix check-package errors]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release notes:
https://lists.exim.org/lurker/message/20251028.114149.3bf19800.en.html
Rebased patch 0001 due to upstream commit
cd43f5ee0f
Rebased patch 0004 due to upstream commit
834dae5565
Added patch 0005 to fix cross-builds.
Added ldflags for mips arch to solve build error with br-mips64-n64-full
defconfig, code copied from package/linux-tools/linux-tool-perf.mk.in:
output/per-package/exim/host/bin/mips64el-linux-ld: dkim_tmp.o: ABI is incompatible with that of the selected emulation
output/per-package/exim/host/bin/mips64el-linux-ld: failed to merge target specific data of file dkim_tmp.o
output/per-package/exim/host/bin/mips64el-linux-ld: dkim_transport.o: ABI is incompatible with that of the selected emulation
output/per-package/exim/host/bin/mips64el-linux-ld: failed to merge target specific data of file dkim_transport.o
output/per-package/exim/host/bin/mips64el-linux-ld: pdkim.o: ABI is incompatible with that of the selected emulation
output/per-package/exim/host/bin/mips64el-linux-ld: failed to merge target specific data of file pdkim.o
output/per-package/exim/host/bin/mips64el-linux-ld: signing.o: ABI is incompatible with that of the selected emulation
output/per-package/exim/host/bin/mips64el-linux-ld: failed to merge target specific data of file signing.o
output/per-package/exim/host/bin/mips64el-linux-ld: attempt to do relocatable link with elf64-tradlittlemips input and elf32-ntradlittlemips output
output/per-package/exim/host/bin/mips64el-linux-ld: dkim_tmp.o: file class ELFCLASS64 incompatible with ELFCLASS32
output/per-package/exim/host/bin/mips64el-linux-ld: final link failed: file in wrong format
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add "Upstream" header in patch 5 to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
For release notes since version 1.35.2, see:
https://github.com/janet-lang/janet/releases
remove upstream patch
diff LICENSE:
-Copyright (c) 2023 Calvin Rose and contributors
+Copyright (c) 2025 Calvin Rose and contributors
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
1.74 Timeout in bcm2835_i2c_write() increased by a factor of 10 because
some users have reported spurious timeouts at slow speeds.
1.75 Patches to bcm2835_aux_spi_transfernb() from Sean Goff to deal with
the case where the process is interrupted between filling the TX
FIFO and reading the RX FIFO.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
