[dunfell][meta-oe][PATCH 0/2] thrift upgrade

[dunfell][meta-oe][PATCH 0/2] thrift upgrade

[Andrej Valek]

Upgrade thrift to version 0.14.2 due to remote security
vulnerability.

Andrej Valek (2):
  thrift: drop unsupported features
  thrift: upgrade to 0.14.2

 ...llationPaths.cmake-Define-libdir-in-terms.patch |  8 +++----
 .../thrift/{thrift_0.13.0.bb => thrift_0.14.2.bb}  | 26 ++++++++++------------
 2 files changed, 16 insertions(+), 18 deletions(-)
 rename meta-oe/recipes-connectivity/thrift/{thrift_0.13.0.bb => thrift_0.14.2.bb} (72%)

-- 
2.11.0

[dunfell][meta-oe][PATCH 1/2] thrift: drop unsupported features

[Andrej Valek]

- QT4 support was dropped
- Feature for switching between boost and std pointer was dropped
 - only std pointers are supported since version 0.13.0

Signed-off-by: Andrej Valek <andrej.valek@siemens.com>
---
 meta-oe/recipes-connectivity/thrift/thrift_0.13.0.bb | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/meta-oe/recipes-connectivity/thrift/thrift_0.13.0.bb b/meta-oe/recipes-connectivity/thrift/thrift_0.13.0.bb
index 92bcb21bf..e3880b357 100644
--- a/meta-oe/recipes-connectivity/thrift/thrift_0.13.0.bb
+++ b/meta-oe/recipes-connectivity/thrift/thrift_0.13.0.bb
@@ -24,7 +24,6 @@ export BUILD_SYS
 export HOST_SYS
 
 EXTRA_OECMAKE = " \
-    -DENABLE_PRECOMPILED_HEADERS=OFF \
     -DBUILD_LIBRARIES=ON \
     -DBUILD_COMPILER=ON \
     -DBUILD_TESTING=OFF \
@@ -36,15 +35,12 @@ EXTRA_OECMAKE = " \
     -DWITH_STATIC_LIB=ON \
     -DWITH_SHARED_LIB=ON \
     -DWITH_OPENSSL=ON \
-    -DWITH_QT4=OFF \
     -DWITH_QT5=OFF \
-    -DWITH_BOOST_FUNCTIONAL=OFF \
 "
 
-PACKAGECONFIG ??= "libevent glib boost-smart-ptr"
+PACKAGECONFIG ??= "libevent glib"
 PACKAGECONFIG[libevent] = "-DWITH_LIBEVENT=ON,-DWITH_LIBEVENT=OFF,libevent"
 PACKAGECONFIG[glib] = "-DWITH_C_GLIB=ON,-DWITH_C_GLIB=OFF,glib-2.0"
-PACKAGECONFIG[boost-smart-ptr] = "-DWITH_BOOST_SMART_PTR=ON,-DWITH_BOOST_SMART_PTR=OFF,boost"
 
 do_install_append () {
     ln -sf thrift ${D}/${bindir}/thrift-compiler
-- 
2.11.0

Re: [oe] [dunfell][meta-oe][PATCH 0/2] thrift upgrade

[Armin Kuster]

On 8/10/21 6:55 AM, Andrej Valek wrote:
> Upgrade thrift to version 0.14.2 due to remote security
> vulnerability.
No specific security issues are mentioned in the other patches. This is
a big jump and from what I can decode from their release notes. They
deprecate many things between these two versions.

Unless I can be convinced otherwise, this update is deemed outside the
acceptable norms for a stable release.

I think backport the specific security issues may be  more appropriate.

thanks,
Armin

> Andrej Valek (2):
>   thrift: drop unsupported features
>   thrift: upgrade to 0.14.2
>
>  ...llationPaths.cmake-Define-libdir-in-terms.patch |  8 +++----
>  .../thrift/{thrift_0.13.0.bb => thrift_0.14.2.bb}  | 26 ++++++++++------------
>  2 files changed, 16 insertions(+), 18 deletions(-)
>  rename meta-oe/recipes-connectivity/thrift/{thrift_0.13.0.bb => thrift_0.14.2.bb} (72%)
>
>
> 
>

Re: [oe] [dunfell][meta-oe][PATCH 0/2] thrift upgrade

[Andrej Valek]

[-- Attachment #1: Type: text/plain, Size: 1177 bytes --]

Hello Armin,

Take a look at the CVE-2020-13949 (https://issues.apache.org/jira/browse/THRIFT-5237). Backporting just those patches is probably no go, that's reason why I chose the upgrade option.

Regards,
Andrej

> On 8/10/21 6:55 AM, Andrej Valek wrote:
>> Upgrade thrift to version 0.14.2 due to remote security
>> vulnerability.
> No specific security issues are mentioned in the other patches. This is a big jump and from what I can decode from their release notes. They deprecate many things between these two versions.
>
> Unless I can be convinced otherwise, this update is deemed outside the acceptable norms for a stable release.
>
> I think backport the specific security issues may be  more appropriate.
>
> thanks,
> Armin
>
>> Andrej Valek (2):
>>   thrift: drop unsupported features
>>   thrift: upgrade to 0.14.2
>>
>>  ...llationPaths.cmake-Define-libdir-in-terms.patch |  8 +++----
>>  .../thrift/{thrift_0.13.0.bb => thrift_0.14.2.bb}  | 26 ++++++++++------------
>>  2 files changed, 16 insertions(+), 18 deletions(-)
>>  rename meta-oe/recipes-connectivity/thrift/{thrift_0.13.0.bb => thrift_0.14.2.bb} (72%)
>>
>>
>> 
>>


[-- Attachment #2: Type: text/html, Size: 3176 bytes --]