Sandbox/rdutta/3.0/update 3.0.20250521 3.0 v3 by ranjan-dutta · Pull Request #294 · open-edge-platform/edge-microvisor-toolkit

ranjan-dutta · 2025-07-10T03:29:33Z

Merge Checklist

All boxes should be checked before merging the PR

[] The changes in the PR have been built and tested
[] cgmanifest file has been updated if required
[] Ready to merge

Description

AZL Tag update 3.0.20250521-3.0-v3

Any Newly Introduced Dependencies

How Has This Been Tested?

…(#13249)

…tapackage (#12298)

This is early work to build a kernel in the extended repo that includes LVBS support.

…ch 3.0-dev (#13365) Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>

…3.0-dev (#13366) Co-authored-by: jykanase <v-jykanase@microsoft.com>

….0-dev (#13367) Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>

….0-dev (#13368) Co-authored-by: Sreenivasulu Malavathula (HCL Technologies Ltd) <v-smalavathu@microsoft.com>

…-dev (#13369) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

…3.0-dev (#13370) Co-authored-by: Kevin Lockwood <57274670+kevin-b-lockwood@users.noreply.github.com>

…h 3.0-dev (#13371) Co-authored-by: jykanase <v-jykanase@microsoft.com>

…Medium] - branch 3.0-dev (#13372) Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>

…ev (#13373) Co-authored-by: kgodara912 <kshigodara@outlook.com>

…m] - branch 3.0-dev (#13374) Co-authored-by: Sumedh Alok Sharma <sumsharma@microsoft.com>

…h 3.0-dev (#13375) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

…2024-11053 [High] - branch 3.0-dev (#13376) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

…ch 3.0-dev (#13389) Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>

…3.0-dev (#13390) Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>

…[Medium] - branch 3.0-dev (#13391) Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>

…v (#13392) Co-authored-by: jykanase <v-jykanase@microsoft.com>

… branch 3.0-dev (#13393) Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>

…nch 3.0-dev (#13394) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

…gs (#13674) Updated the config options in config_aarch64 as per nvidia's recently published patch guide. The config options are related to GB200 and GB200F helps h/w team to run the diagnostics. Made modification to config_aarch64 based on nvidia's recommendation. nvidia patch guide: https://docs.nvidia.com/grace-patch-config-guide.pdf Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>

Signed-off-by: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>

…gs (#13674) Updated the config options in config_aarch64 as per nvidia's recently published patch guide. The config options are related to GB200 and GB200F helps h/w team to run the diagnostics. Made modification to config_aarch64 based on nvidia's recommendation. nvidia patch guide: https://docs.nvidia.com/grace-patch-config-guide.pdf Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>

* tag '3.0.20250521-3.0': (271 commits) Fixed reporting of build errors (CP: #13889) (#13897) Revert "Revert "Merge 3.0-dev for May 2025 2 release"" (#13847) Revert "Anphel/3 mid may 2025 update b" (#13846) kernel-64k: Added a new patch to solve EFI slack slots issue (#13783) kernel-64k: enabling config options required for GB200 and GB200F diags (#13674) Prepare May 2025 Update 2 (#13808) Revert "Merge 3.0-dev for May 2025 2 release" (#13833) kernel-64k: Added a new patch to solve EFI slack slots issue (#13783) Patch docker-buildx for CVE-2025-0495 [Medium] (#13768) [Medium] Patch yasm for CVE-2023-51258 and CVE-2023-37732 (#13792) [Medium] Patch iniparser for CVE-2023-33461 (#13804) [Medium] patch rpm-ostree for CVE-2024-2905 (#13818) kernel-64k: enabling config options required for GB200 and GB200F diags (#13674) [3.0] bmake: move tests to check section (#13815) Updated lua-json to version 1.3.4 (#11179) Upgrade kyotocabinet to version 1.2.80 (#10802) Extended build failure logging (#13705) Prepare May 2025 Update 2 (#13808) dom0 packages: Update to dom0 release v2411.19.1 (#13648) [AUTO-CHERRYPICK] Upgrade SymCrypt-OpenSSL to 1.8.1 - branch 3.0-dev (#13805) ...

.github/workflows/check-srpm-duplicates.yml

+      - name: Workflow trigger checkout
+        uses: actions/checkout@v4
+
+      # For consistency, we use the same major/minor version of Python that Azure Linux ships


.github/workflows/check-srpm-duplicates.yml

+    name: SRPMs duplicates check
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        # Each group is published to a different repo, thus we only need to check
+        # for SRPM duplicates within the group.
+        specs-dirs-groups: ["SPECS SPECS-SIGNED", "SPECS-EXTENDED"]
+
+    steps:
+      # Checkout the branch of our repo that triggered this action
+      - name: Workflow trigger checkout
+        uses: actions/checkout@v4
+
+      # For consistency, we use the same major/minor version of Python that Azure Linux ships
+      - name: Setup Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.12
+
+      # Generate the specs.json files. They are the input for the duplicates check script.
+      - name: Generate specs.json
+        run: |
+          set -euo pipefail
+
+          for spec_folder in ${{ matrix.specs-dirs-groups }}; do
+            echo "Generating specs.json for spec folder '$spec_folder'."
+
+            sudo make -C toolkit -j$(nproc) parse-specs REBUILD_TOOLS=y DAILY_BUILD_ID=lkg SPECS_DIR=../$spec_folder
+            cp -v build/pkg_artifacts/specs.json ${spec_folder}_specs.json
+          done
+
+      - name: Check for duplicate SRPMs
+        run: python3 toolkit/scripts/check_srpm_duplicates.py *_specs.json


To fix the issue, add a permissions block to the workflow. Since the workflow only performs read operations (e.g., checking out code and running scripts), the contents: read permission is sufficient. This change ensures the workflow does not inadvertently inherit write permissions, adhering to the principle of least privilege.

The permissions block should be added at the root level of the workflow file, applying to all jobs within the workflow. No additional imports, methods, or definitions are required.

update with UPDATE_TOOLCHAIN_LIST=y Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>

kevin-b-lockwood and others added 30 commits April 11, 2025 12:57

Update liblqr-1 to 0.4.3 (#10987)

a0e2a01

libblockdev: Version update to 3.2.0 (#10962)

517a68a

hyphen-it: Update Version from 0.20071127 -> 5.1.1 (#10957)

55b0aa9

Upgrade: os-prober version to 1.81 (#11494)

448cb19

[3.0] Fix Patch Application for skopeo (#13340)

f33d943

[3.0] Fix Patch Application for nvidia-container-toolkit (#13345)

9efb56d

flux warnings (#13385)

4b7b5be

Fix to include idmapd.conf and id_resolver.conf in nfs-utils for 3.0 …

840cde4

…(#13249)

[Medium] patch dwarves for CVE-2025-29481 (#13384)

dea7b3a

[Medium] Patch libbpf for CVE-2025-29481 (#13382)

d6f51a5

[3.0] Introduce debug and metapackage and reduce size of non-debug me…

5e37eeb

…tapackage (#12298)

extended repo LVBS kernel (#12064)

a7a419d

This is early work to build a kernel in the extended repo that includes LVBS support.

[AUTO-CHERRYPICK] [MEDIUM] Patch numpy to fix CVE-2018-1999024 - bran…

fe43366

…ch 3.0-dev (#13365) Co-authored-by: Archana Shettigar <v-shettigara@microsoft.com>

[AUTO-CHERRYPICK] [Medium] Patch dietlibc for CVE-2015-1473 - branch …

ff1447f

…3.0-dev (#13366) Co-authored-by: jykanase <v-jykanase@microsoft.com>

[AUTO-CHERRYPICK] Patch gnutls for CVE-2024-12133 [Medium] - branch 3…

4541f4a

….0-dev (#13367) Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>

[AUTO-CHERRYPICK] [Medium] Patch vitess for CVE-2025-22870 - branch 3…

1050cd8

….0-dev (#13368) Co-authored-by: Sreenivasulu Malavathula (HCL Technologies Ltd) <v-smalavathu@microsoft.com>

[AUTO-CHERRYPICK] Patch ceph for CVE-2021-28361 [High] - branch 3.0…

1b8b37e

…-dev (#13369) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

[AUTO-CHERRYPICK] [Low] Patch subversion for CVE-2024-46901 - branch …

d9ccd92

…3.0-dev (#13370) Co-authored-by: Kevin Lockwood <57274670+kevin-b-lockwood@users.noreply.github.com>

[AUTO-CHERRYPICK] [Medium] patch memcached for CVE-2021-44647 - branc…

540b2d2

…h 3.0-dev (#13371) Co-authored-by: jykanase <v-jykanase@microsoft.com>

[AUTO-CHERRYPICK] Patch prometheus-node-exporter for CVE-2025-22870 […

fbfacda

…Medium] - branch 3.0-dev (#13372) Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>

[AUTO-CHERRYPICK] Patch expat for CVE-2024-8176 [HIGH] - branch 3.0-d…

8fa8595

…ev (#13373) Co-authored-by: kgodara912 <kshigodara@outlook.com>

[AUTO-CHERRYPICK] Upgrade libssh2 to 1.11.1 for CVE-2023-48795 [Mediu…

8fd0d89

…m] - branch 3.0-dev (#13374) Co-authored-by: Sumedh Alok Sharma <sumsharma@microsoft.com>

[AUTO-CHERRYPICK] Patch blobfuse2 for CVE-2025-30204 [High] - branc…

3fd4c10

…h 3.0-dev (#13375) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

[AUTO-CHERRYPICK] Upgrade mysql to 8.0.41 for CVE-2025-21490 & CVE-…

91dd93a

…2024-11053 [High] - branch 3.0-dev (#13376) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

[AUTO-CHERRYPICK] Patch fluent-bit for CVE-2025-31498 [High] - bran…

8611275

…ch 3.0-dev (#13389) Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>

[AUTO-CHERRYPICK] Patch git-lfs for CVE-2025-22870 [Medium] - branch …

ba1ccd5

…3.0-dev (#13390) Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>

[AUTO-CHERRYPICK] Patch prometheus-process-exporter for CVE-2025-22870 …

a09e742

…[Medium] - branch 3.0-dev (#13391) Co-authored-by: Rohit Rawat <rohitrawat@microsoft.com>

[AUTO-CHERRYPICK] [Low] patch clang for CVE-2024-7883 - branch 3.0-de…

b397f4c

…v (#13392) Co-authored-by: jykanase <v-jykanase@microsoft.com>

[AUTO-CHERRYPICK] Patch rabbitmq-server for CVE-2025-30219 [Medium] -…

c045460

… branch 3.0-dev (#13393) Co-authored-by: Ankita Pareek <56152556+Ankita13-code@users.noreply.github.com>

[AUTO-CHERRYPICK] Patch wpa_supplicant for CVE-2025-24912 [Low] - bra…

b43cf80

…nch 3.0-dev (#13394) Co-authored-by: Kanishk Bansal <103916909+Kanishk-Bansal@users.noreply.github.com>

PawelWMS and others added 24 commits May 15, 2025 16:04

Prepare May 2025 Update 2 (#13808)

49e7d7d

Merge 3.0-dev for May 2025 2 release

02ceb98

Extended build failure logging (#13705)

8a67fc4

Latest 3.0-dec update.

28f87c2

Merge 3.0-dev for May 2025 2 release (#13809)

cab4240

Upgrade kyotocabinet to version 1.2.80 (#10802)

469ae7b

Updated lua-json to version 1.3.4 (#11179)

293fd84

[3.0] bmake: move tests to check section (#13815)

10abee5

[Medium] patch rpm-ostree for CVE-2024-2905 (#13818)

837e7d7

[Medium] Patch iniparser for CVE-2023-33461 (#13804)

d944fbb

Signed-off-by: Sreenivasulu Malavathula <v-smalavathu@microsoft.com>

[Medium] Patch yasm for CVE-2023-51258 and CVE-2023-37732 (#13792)

98835ba

Patch docker-buildx for CVE-2025-0495 [Medium] (#13768)

91ef9b2

kernel-64k: Added a new patch to solve EFI slack slots issue (#13783)

e19b003

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>

Revert "Merge 3.0-dev for May 2025 2 release" (#13833)

dc78d7c

Prepare May 2025 Update 2 (#13808)

4754737

kernel-64k: Added a new patch to solve EFI slack slots issue (#13783)

696dc13

Co-authored-by: Rachel Menge <rachelmenge@microsoft.com>

Anphel/3 mid may 2025 update b (#13839)

1de4113

Revert "Anphel/3 mid may 2025 update b" (#13846)

8fd0667

Revert "Revert "Merge 3.0-dev for May 2025 2 release"" (#13847)

da84812

Sync 3.0-dev to 3.0 as of e19b003 (#13848)

3d04526

Fixed reporting of build errors (CP: #13889) (#13897)

3cd11c5

ranjan-dutta requested a review from a team as a code owner July 10, 2025 03:29

github-advanced-security bot found potential problems Jul 10, 2025

View reviewed changes

update toolkit/resources/manifests/package/toolchain_x86_64.txt

e6556ef

update with UPDATE_TOOLCHAIN_LIST=y Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>

cheeyanglee closed this Jul 24, 2025

anujm1 deleted the sandbox/rdutta/3.0/update-3.0.20250521-3.0-v3 branch August 28, 2025 11:32

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Sandbox/rdutta/3.0/update 3.0.20250521 3.0 v3#294

Sandbox/rdutta/3.0/update 3.0.20250521 3.0 v3#294
ranjan-dutta wants to merge 281 commits into3.0-devfrom
sandbox/rdutta/3.0/update-3.0.20250521-3.0-v3

ranjan-dutta commented Jul 10, 2025

Uh oh!

Check warning

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

@@ -7,2 +7,5 @@
+            permissions:
+              contents: read
             on:

Conversation

ranjan-dutta commented Jul 10, 2025

Merge Checklist

Description

Any Newly Introduced Dependencies

How Has This Been Tested?

Uh oh!

Check warning

Check warning

Copilot Autofix

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants