Complete Yocto mirror with license table for TQMa6UL (2038-compliance)

- 264 license table entries with exact download URLs (224/264 resolved)
- Complete sources/ directory with all BitBake recipes
- Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl)
- Full traceability for Softwarefreigabeantrag
- GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4
- License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)

sources/poky/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch

@@ -0,0 +1,66 @@
+From 325a4cde99a00b84116ab7111d27e6973f3c5026 Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex@linutronix.de>
+Date: Thu, 26 Jan 2023 20:29:46 +0100
+Subject: [PATCH] meson.build: allow (a subset of) tests in cross compile
+ settings
+
+There is no need to completely disable tests: most of them
+do not require running target executables at build time,
+and so can be built and installed.
+
+This requires inserting a couple of specific guards around
+items that do require running target executables.
+
+Upstream-Status: Submitted [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/150]
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+---
+ meson.build       |  6 +++---
+ tests/meson.build | 10 ++++++----
+ 2 files changed, 9 insertions(+), 7 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 3eb3fcc..dc7e790 100644
+--- a/meson.build
++++ b/meson.build
+@@ -390,10 +390,10 @@ subdir('gdk-pixbuf')
+ # i18n
+ subdir('po')
+ 
++if get_option('tests')
++  subdir('tests')
++endif
+ if not meson.is_cross_build()
+-  if get_option('tests')
+-    subdir('tests')
+-  endif
+   subdir('thumbnailer')
+ endif
+ 
+diff --git a/tests/meson.build b/tests/meson.build
+index 3781066..911b5fb 100644
+--- a/tests/meson.build
++++ b/tests/meson.build
+@@ -4,7 +4,7 @@
+ # gdk-pixbuf-pixdata from build directory because it needs all DLL locations in
+ # $PATH. Ideally we should use gnome.compile_resources() and let Meson deal with
+ # this problem: See https://github.com/mesonbuild/meson/issues/8266.
+-if enabled_loaders.contains('png') and host_system != 'windows'
++if enabled_loaders.contains('png') and host_system != 'windows' and not meson.is_cross_build()
+   # Resources; we cannot use gnome.compile_resources() here, because we need to
+   # override the environment in order to use the utilities we just built instead
+   # of the system ones
+@@ -164,9 +164,11 @@ endif
+ test_deps = gdk_pixbuf_deps + [ gdkpixbuf_dep, ]
+ test_args = [ '-k' ]
+ test_env = environment()
+-test_env.set('G_TEST_SRCDIR', meson.current_source_dir())
+-test_env.set('G_TEST_BUILDDIR', meson.current_build_dir())
+-test_env.set('GDK_PIXBUF_MODULE_FILE', loaders_cache.full_path())
++if not meson.is_cross_build()
++  test_env.set('G_TEST_SRCDIR', meson.current_source_dir())
++  test_env.set('G_TEST_BUILDDIR', meson.current_build_dir())
++  test_env.set('GDK_PIXBUF_MODULE_FILE', loaders_cache.full_path())
++endif
+ 
+ foreach test_name, test_data: installed_tests
+   test_sources = [ test_name + '.c', 'test-common.c' ]

sources/poky/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/CVE-2025-7345.patch

@@ -0,0 +1,55 @@
+From 4af78023ce7d3b5e3cec422a59bb4f48fa4f5886 Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Fri, 11 Jul 2025 11:02:05 -0400
+Subject: [PATCH] jpeg: Be more careful with chunked icc data
+
+We we inadvertendly trusting the sequence numbers not to lie.
+If they do we would report a larger data size than we actually
+allocated, leading to out of bounds memory access in base64
+encoding later on.
+
+This has been assigned CVE-2025-7345.
+
+Fixes: #249
+
+CVE: CVE-2025-7345
+
+Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/4af78023ce7d3b5e3cec422a59bb4f48fa4f5886]
+
+Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
+---
+ gdk-pixbuf/io-jpeg.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/gdk-pixbuf/io-jpeg.c b/gdk-pixbuf/io-jpeg.c
+index 3841fc0..9ee1d21 100644
+--- a/gdk-pixbuf/io-jpeg.c
++++ b/gdk-pixbuf/io-jpeg.c
+@@ -356,6 +356,7 @@ jpeg_parse_exif_app2_segment (JpegExifContext *context, jpeg_saved_marker_ptr ma
+		context->icc_profile = g_new (gchar, chunk_size);
+		/* copy the segment data to the profile space */
+		memcpy (context->icc_profile, marker->data + 14, chunk_size);
++                ret = TRUE;
+		goto out;
+	}
+
+@@ -377,12 +378,15 @@ jpeg_parse_exif_app2_segment (JpegExifContext *context, jpeg_saved_marker_ptr ma
+	/* copy the segment data to the profile space */
+	memcpy (context->icc_profile + offset, marker->data + 14, chunk_size);
+
+-	/* it's now this big plus the new data we've just copied */
+-	context->icc_profile_size += chunk_size;
++        context->icc_profile_size = MAX (context->icc_profile_size, offset + chunk_size);
+
+	/* success */
+	ret = TRUE;
+ out:
++        if (!ret) {
++                g_free (context->icc_profile);
++                context->icc_profile = NULL;
++        }
+	return ret;
+ }
+
+--
+2.40.0

sources/poky/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/fatal-loader.patch

@@ -0,0 +1,88 @@
+From f78ab4edaee5f62663a9a4bcfa56e5c524da4474 Mon Sep 17 00:00:00 2001
+From: Ross Burton <ross.burton@intel.com>
+Date: Tue, 1 Apr 2014 17:23:36 +0100
+Subject: [PATCH] gdk-pixbuf: add an option so that loader errors are fatal
+
+If an environment variable is specified set the return value from main() to
+non-zero if the loader had errors (missing libraries, generally).
+
+Upstream-Status: Submitted [https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/144]
+Signed-off-by: Ross Burton <ross.burton@intel.com>
+---
+ gdk-pixbuf/queryloaders.c | 19 +++++++++++++++----
+ 1 file changed, 15 insertions(+), 4 deletions(-)
+
+diff --git a/gdk-pixbuf/queryloaders.c b/gdk-pixbuf/queryloaders.c
+index baa9a5c..9b6fa89 100644
+--- a/gdk-pixbuf/queryloaders.c
++++ b/gdk-pixbuf/queryloaders.c
+@@ -216,7 +216,7 @@ write_loader_info (GString *contents, const char *path, GdkPixbufFormat *info)
+         g_string_append_c (contents, '\n');
+ }
+ 
+-static void
++static gboolean
+ query_module (GString *contents, const char *dir, const char *file)
+ {
+         char *path;
+@@ -225,6 +225,7 @@ query_module (GString *contents, const char *dir, const char *file)
+         void                    (*fill_vtable)   (GdkPixbufModule *module);
+         gpointer fill_info_ptr;
+         gpointer fill_vtable_ptr;
++        gboolean ret = TRUE;
+ 
+         if (g_path_is_absolute (file))
+                 path = g_strdup (file);
+@@ -274,10 +275,13 @@ query_module (GString *contents, const char *dir, const char *file)
+                                    g_module_error());
+                 else
+                         g_fprintf (stderr, "Cannot load loader %s\n", path);
++                ret = FALSE;
+         }
+         if (module)
+                 g_module_close (module);
+         g_free (path);
++
++        return ret;
+ }
+ 
+ #if defined(G_OS_WIN32) && defined(GDK_PIXBUF_RELOCATABLE)
+@@ -318,6 +322,7 @@ int main (int argc, char **argv)
+         gint first_file = 1;
+         GFile *pixbuf_libdir_file;
+         gchar *pixbuf_libdir;
++        gboolean success = TRUE;
+ 
+ #ifdef G_OS_WIN32
+         gchar *libdir;
+@@ -456,7 +461,9 @@ int main (int argc, char **argv)
+                 }
+                 modules = g_list_sort (modules, (GCompareFunc)strcmp);
+                 for (l = modules; l != NULL; l = l->next)
+-                        query_module (contents, moduledir, l->data);
++                        if (!query_module (contents, moduledir, l->data))
++                                success = FALSE;
++
+                 g_list_free_full (modules, g_free);
+                 g_free (moduledir);
+ #else
+@@ -472,7 +479,8 @@ int main (int argc, char **argv)
+                         infilename = g_locale_to_utf8 (infilename,
+                                                        -1, NULL, NULL, NULL);
+ #endif
+-                        query_module (contents, cwd, infilename);
++                        if (!query_module (contents, cwd, infilename))
++                                success = FALSE;
+                 }
+                 g_free (cwd);
+         }
+@@ -492,5 +500,8 @@ int main (int argc, char **argv)
+ 
+         g_free (pixbuf_libdir);
+ 
+-        return 0;
++        if (g_getenv ("GDK_PIXBUF_FATAL_LOADER"))
++                return success ? 0 : 1;
++        else
++                return 0;
+ }

sources/poky/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf/run-ptest

@@ -0,0 +1,3 @@
+#! /bin/sh
+
+gnome-desktop-testing-runner gdk-pixbuf

sources/poky/meta/recipes-gnome/gdk-pixbuf/gdk-pixbuf_2.42.12.bb

@@ -0,0 +1,120 @@
+SUMMARY = "Image loading library for GTK+"
+DESCRIPTION = "The GDK Pixbuf library provides: Image loading and saving \
+facilities, fast scaling and compositing of pixbufs and Simple animation \
+loading (ie. animated GIFs)"
+HOMEPAGE = "https://wiki.gnome.org/Projects/GdkPixbuf"
+BUGTRACKER = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/issues"
+
+LICENSE = "LGPL-2.1-or-later"
+LIC_FILES_CHKSUM = "file://COPYING;md5=4fbd65380cdd255951079008b364516c \
+                    file://gdk-pixbuf/gdk-pixbuf.h;endline=26;md5=72b39da7cbdde2e665329fef618e1d6b \
+                    "
+
+SECTION = "libs"
+
+DEPENDS = "glib-2.0 shared-mime-info"
+
+MAJ_VER = "${@oe.utils.trim_version("${PV}", 2)}"
+
+SRC_URI = "${GNOME_MIRROR}/${BPN}/${MAJ_VER}/${BPN}-${PV}.tar.xz \
+           file://run-ptest \
+           file://fatal-loader.patch \
+           file://0001-meson.build-allow-a-subset-of-tests-in-cross-compile.patch \
+           file://CVE-2025-7345.patch \
+           "
+
+SRC_URI[sha256sum] = "b9505b3445b9a7e48ced34760c3bcb73e966df3ac94c95a148cb669ab748e3c7"
+
+inherit meson pkgconfig gettext pixbufcache ptest-gnome upstream-version-is-even gobject-introspection gi-docgen lib_package
+
+GIR_MESON_OPTION = 'introspection'
+GIR_MESON_ENABLE_FLAG = "enabled"
+GIR_MESON_DISABLE_FLAG = "disabled"
+
+LIBV = "2.10.0"
+
+GDK_PIXBUF_LOADERS ?= "png jpeg"
+
+PACKAGECONFIG = "${GDK_PIXBUF_LOADERS} \
+                 ${@bb.utils.contains('PTEST_ENABLED', '1', 'tests', '', d)}"
+PACKAGECONFIG:class-native = "${GDK_PIXBUF_LOADERS}"
+
+PACKAGECONFIG[png] = "-Dpng=enabled,-Dpng=disabled,libpng"
+PACKAGECONFIG[jpeg] = "-Djpeg=enabled,-Djpeg=disabled,jpeg"
+PACKAGECONFIG[tiff] = "-Dtiff=enabled,-Dtiff=disabled,tiff"
+PACKAGECONFIG[tests] = "-Dinstalled_tests=true,-Dinstalled_tests=false"
+
+EXTRA_OEMESON = "-Dman=false"
+
+PACKAGES =+ "${PN}-xlib"
+
+# For GIO image type sniffing
+RDEPENDS:${PN} = "shared-mime-info"
+
+FILES:${PN}-xlib = "${libdir}/*pixbuf_xlib*${SOLIBS}"
+ALLOW_EMPTY:${PN}-xlib = "1"
+
+FILES:${PN} += "${libdir}/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders"
+
+FILES:${PN}-bin += "${datadir}/thumbnailers/gdk-pixbuf-thumbnailer.thumbnailer"
+
+FILES:${PN}-dev += " \
+	${bindir}/gdk-pixbuf-csource \
+	${bindir}/gdk-pixbuf-pixdata \
+        ${bindir}/gdk-pixbuf-print-mime-types \
+	${includedir}/* \
+	${libdir}/gdk-pixbuf-2.0/${LIBV}/loaders/*.la \
+"
+
+PACKAGES_DYNAMIC += "^gdk-pixbuf-loader-.*"
+PACKAGES_DYNAMIC:class-native = ""
+
+python populate_packages:prepend () {
+    postinst_pixbufloader = d.getVar("postinst_pixbufloader")
+
+    loaders_root = d.expand('${libdir}/gdk-pixbuf-2.0/${LIBV}/loaders')
+
+    packages = ' '.join(do_split_packages(d, loaders_root, r'^libpixbufloader-(.*)\.so$', 'gdk-pixbuf-loader-%s', 'GDK pixbuf loader for %s'))
+    d.setVar('PIXBUF_PACKAGES', packages)
+
+    # The test suite exercises all the loaders, so ensure they are all
+    # dependencies of the ptest package.
+    d.appendVar("RDEPENDS:%s-ptest" % d.getVar('PN'), " " + packages)
+}
+
+do_install:append() {
+	# Copy gdk-pixbuf-query-loaders into libdir so it is always available
+	# in multilib builds.
+	cp ${D}/${bindir}/gdk-pixbuf-query-loaders ${D}/${libdir}/gdk-pixbuf-2.0/
+
+}
+
+do_install_ptest() {
+        # Remove a bad fuzzing attempt that sporadically fails without a way to reproduce
+	rm ${D}/${datadir}/installed-tests/gdk-pixbuf/pixbuf-randomly-modified.test
+        # https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/issues/215
+	rm ${D}/${datadir}/installed-tests/gdk-pixbuf/pixbuf-jpeg.test
+}
+
+do_install:append:class-native() {
+	find ${D}${libdir} -name "libpixbufloader-*.la" -exec rm \{\} \;
+
+	create_wrapper ${D}/${bindir}/gdk-pixbuf-csource \
+		XDG_DATA_DIRS=${STAGING_DATADIR} \
+		GDK_PIXBUF_MODULE_FILE=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders.cache
+
+	create_wrapper ${D}/${bindir}/gdk-pixbuf-pixdata \
+		XDG_DATA_DIRS=${STAGING_DATADIR} \
+		GDK_PIXBUF_MODULE_FILE=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders.cache
+
+	create_wrapper ${D}/${libdir}/gdk-pixbuf-2.0/gdk-pixbuf-query-loaders \
+		XDG_DATA_DIRS=${STAGING_DATADIR} \
+		GDK_PIXBUF_MODULE_FILE=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders.cache \
+		GDK_PIXBUF_MODULEDIR=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders
+
+	create_wrapper ${D}/${bindir}/gdk-pixbuf-query-loaders \
+		XDG_DATA_DIRS=${STAGING_DATADIR} \
+		GDK_PIXBUF_MODULE_FILE=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders.cache \
+		GDK_PIXBUF_MODULEDIR=${STAGING_LIBDIR_NATIVE}/gdk-pixbuf-2.0/${LIBV}/loaders
+}
+BBCLASSEXTEND = "native nativesdk"