Version updates

Add libxv dependency only when libavdevice is enabled (as nothing else needs it).

Signed-off-by Alexander Kanavin <[email protected]>

---
 .../ffmpeg/{ffmpeg_2.8.5.bb => ffmpeg_2.8.6.bb}                   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 rename meta/recipes-multimedia/ffmpeg/{ffmpeg_2.8.5.bb => ffmpeg_2.8.6.bb} (94%)

meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.6.bb renamed from meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.5.bb +4 -4

similarity index 94%
rename from meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.5.bb
rename to meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.6.bb
index 7107803..72393b3 100644
@@ -15,19 +15,19 @@ LIC_FILES_CHKSUM = "file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 
 SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz"
 
-SRC_URI[md5sum] = "b34164bd181f4f81c21da3dd131d919d"
-SRC_URI[sha256sum] = "76fb83a267d2d1cb332742dadf28ad8b58af7958165f51bb1a2c226a122f0ac7"
+SRC_URI[md5sum] = "0cff5dae51375f0a31a651f986ed1534"
+SRC_URI[sha256sum] = "25bcedbdafadac3d09c325c1d46a51f53d858b26a260d5aed6b4f17fea6e07fa"
 
 # Should be API compatible with libav (which was a fork of ffmpeg)
 # libpostproc was previously packaged from a separate recipe
 PROVIDES = "libav libpostproc"
 
-DEPENDS = "alsa-lib zlib libogg yasm-native libxv"
+DEPENDS = "alsa-lib zlib libogg yasm-native"
 
 inherit autotools pkgconfig
 
 PACKAGECONFIG ??= "avdevice avfilter gpl theora x264 ${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}"
-PACKAGECONFIG[avdevice] = "--enable-avdevice,--disable-avdevice"
+PACKAGECONFIG[avdevice] = "--enable-avdevice,--disable-avdevice, libxv"
 PACKAGECONFIG[avfilter] = "--enable-avfilter,--disable-avfilter"
 PACKAGECONFIG[faac] = "--enable-libfaac,--disable-libfaac,faac"
 PACKAGECONFIG[gpl] = "--enable-gpl,--disable-gpl"

Signed-off-by Alexander Kanavin <[email protected]>

---
 meta/recipes-sato/webkit/{webkitgtk_2.10.5.bb => webkitgtk_2.10.7.bb} | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 rename meta/recipes-sato/webkit/{webkitgtk_2.10.5.bb => webkitgtk_2.10.7.bb} (96%)

meta/recipes-sato/webkit/webkitgtk_2.10.7.bb renamed from meta/recipes-sato/webkit/webkitgtk_2.10.5.bb +2 -2

similarity index 96%
rename from meta/recipes-sato/webkit/webkitgtk_2.10.5.bb
rename to meta/recipes-sato/webkit/webkitgtk_2.10.7.bb
index fba3108..8812967 100644
@@ -16,8 +16,8 @@ SRC_URI = "\
   file://0001-Enable-backtrace-on-linux-when-using-glibc.patch \
   file://0001-Fix-build-with-non-glibc-libraries-on-linux.patch \
   "
-SRC_URI[md5sum] = "bb3bd727960630bb4cbaddf8b1632d18"
-SRC_URI[sha256sum] = "785d5e98eaf07be15fb8891b7d5b13a2df7072c609b3ee631ca07d5dea1d79fa"
+SRC_URI[md5sum] = "84832b9d8329413b4f1d87df5f7e8efe"
+SRC_URI[sha256sum] = "990d62c82ed6dede31a6ff0a82d847f16b812842ff3e1093d17113627652864e"
 
 inherit cmake lib_package pkgconfig perlnative pythonnative distro_features_check upstream-version-is-even
 

this update includes:

CVE-2015-7096
Versions affected: WebKitGTK+ before 2.10.5.

CVE-2015-7098
Versions affected: WebKitGTK+ before 2.10.5.

http://webkitgtk.org/security.html

Quoted 6 lines · On 02/11/2016 09:08 PM, akuster808 wrote:

this update includes:

CVE-2015-7096
Versions affected: WebKitGTK+ before 2.10.5.

Quoted 5 lines

CVE-2015-7098
Versions affected: WebKitGTK+ before 2.10.5.

http://webkitgtk.org/security.html

Yes, which means that jethro (which has 2.8.5) needs the same update.

Generally, this manual check for vulnerabilities is error-prone and doesn't scale. We really should automate cve checks (using cve-check-tool or something similar) when doing package builds, I'll try to look if it's feasible. There's been an open bug for a long time:

https://bugzilla.yoctoproject.org/show_bug.cgi?id=7515

Alex

Add libxv dependency only when libavdevice is enabled (as nothing else needs it).

Signed-off-by Alexander Kanavin <[email protected]>

---
 .../ffmpeg/{ffmpeg_2.8.5.bb => ffmpeg_2.8.6.bb}                   | 8
++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
 rename meta/recipes-multimedia/ffmpeg/{ffmpeg_2.8.5.bb => ffmpeg_2.8.6.bb}

(94%)

meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.6.bb renamed from meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.5.bb +0 -2

similarity index 94%
rename from meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.5.bb
rename to meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.6.bb
index 7107803..72393b3 100644
@@ -15,19 +15,19 @@ LIC_FILES_CHKSUM =
 "file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 
 SRC_URI = "https://www.ffmpeg.org/releases/${BP}.tar.xz"
 
-SRC_URI[md5sum] = "b34164bd181f4f81c21da3dd131d919d"
-SRC_URI[sha256sum] =

"76fb83a267d2d1cb332742dadf28ad8b58af7958165f51bb1a2c226a122f0ac7"

meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.6.bb renamed from meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.5.bb +2 -0

+SRC_URI[md5sum] = "0cff5dae51375f0a31a651f986ed1534"
+SRC_URI[sha256sum] =

"25bcedbdafadac3d09c325c1d46a51f53d858b26a260d5aed6b4f17fea6e07fa"

# Should be API compatible with libav (which was a fork of ffmpeg)

 # libpostproc was previously packaged from a separate recipe
 PROVIDES = "libav libpostproc"

meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.6.bb renamed from meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.5.bb +1 -1

-DEPENDS = "alsa-lib zlib libogg yasm-native libxv"
+DEPENDS = "alsa-lib zlib libogg yasm-native"
 
 inherit autotools pkgconfig
 
 PACKAGECONFIG ??= "avdevice avfilter gpl theora x264

${@bb.utils.contains('DISTRO_FEATURES', 'x11', 'x11', '', d)}"

meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.6.bb renamed from meta/recipes-multimedia/ffmpeg/ffmpeg_2.8.5.bb +1 -2

-PACKAGECONFIG[avdevice] = "--enable-avdevice,--disable-avdevice"
+PACKAGECONFIG[avdevice] = "--enable-avdevice,--disable-avdevice, libxv"
 PACKAGECONFIG[avfilter] = "--enable-avfilter,--disable-avfilter"
 PACKAGECONFIG[faac] = "--enable-libfaac,--disable-libfaac,faac"
 PACKAGECONFIG[gpl] = "--enable-gpl,--disable-gpl"
--

2.7.0

--
_______________________________________________
Openembedded-core mailing list
[email protected]
http://lists.openembedded.org/mailman/listinfo/openembedded-core

Quoted 1 line

Yes, which means that jethro (which has 2.8.5) needs the same update.

there is a bug open for that 8877. there are a huge number of CVE's that need fixing.

Fails to build for qemuarm when thumb is enabled.

Why was:
ARM_INSTRUCTION_SET = "arm"

removed in
http://git.openembedded.org/openembedded-core/commit/?id=77dbf07293df15cd5473422abd678930d6277bb0

without checking if it works?

Quoted 9 lines · Martin Jansa

Fails to build for qemuarm when thumb is enabled.

Why was:
ARM_INSTRUCTION_SET = "arm"

removed in
http://git.openembedded.org/openembedded-core/commit/?id=77dbf07293df15cd5473422abd678930d6277bb0

without checking if it works?

That line has no explanation of its intent and dates back to before 2009. I had also checked that ffmpeg builds fine with default qemuarm configuration (and just checked that it still does), so it was dropped as old cruft.

I see that 'thumb' is in TUNE_FEATURES for qemuarm, but not sure if that is same as 'thumb is enabled'. How do I make it break?

The distro needs to set ARM_INSTRUCTION_SET to "thumb" in order to enable actually using this TUNE_FEATURE.

With recent improvements in tune files you should clearly see that default qemuarm builds are using TUNE_PKGARCH without "t" in it which means that "thumb" isn't enabled.

Quoted 6 lines · Martin Jansa

The distro needs to set ARM_INSTRUCTION_SET to "thumb" in order to enable actually using this TUNE_FEATURE.

With recent improvements in tune files you should clearly see that default qemuarm builds are using TUNE_PKGARCH without "t" in it which means that "thumb" isn't enabled.

Should we actually test this on autobuilders then? The change passed them fine, even though it shouldn't have.

Quoted 4 lines · On 02/16/2016 05:55 PM, akuster808 wrote:

Quoted 1 line

Yes, which means that jethro (which has 2.8.5) needs the same update.

there is a bug open for that 8877. there are a huge number of CVE's that need fixing.

I wrote a comment in that bug, but I think it bears repeating here:

Please read this, it's a bit long, but worth it:

https://blogs.gnome.org/mcatanzaro/2016/02/01/on-webkit-security-updates/

Summary: the upstream will not backport CVE fixes, and they will not be making point releases in old branches with any kind of lifecycle guarantee. Providing ongoing updates to the latest stable release of webkit is the only way to stay secure.

So I believe that you indeed have to update webkit to 2.10.7, or whatever is the latest stable release, and keep doing this for as long as a yocto release needs to be supported.

Regards,
Alex

Many vulnerability notifications will make the same statements.

Updating a package that other packages depend on can cause a cascading set of failures. Now you have a bigger set of problems to contend with.

From the commercial side you just can't move your install base to the
latest package versions for every security issue. The Yocto maintenance policy operates very close to this too.