Release: merge master-next to master (2026-04-22)

.github/workflows/auto-backport.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Create backport pull requests
         uses: korthout/backport-action@v4
         with:
-          target_branches: kirkstone-next scarthgap-next whinlatter-next
+          target_branches: scarthgap-next whinlatter-next
           # copy all labels (backport labels are automatically skipped)
           copy_labels_pattern: .+
           github_token: ${{ secrets.MAINTAINER_TOKEN }}

.github/workflows/build-test-all-branches.yml

@@ -21,7 +21,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -x  # Enable command echo for debugging
-          branches=("master" "master-next" "scarthgap" "scarthgap-next" "kirkstone" "kirkstone-next" "whinlatter" "whinlatter-next")
+          branches=("master" "master-next" "scarthgap" "scarthgap-next" "whinlatter" "whinlatter-next")
           declare -A run_ids
           declare -A run_urls
           for branch in "${branches[@]}"; do

.github/workflows/ff-merge.yml

@@ -4,7 +4,7 @@ on:
       inputs:
         branches:
           description: 'branches to ff merge branch-next into'
-          default: '["master", "dunfell", "gatesgarth", "hardknott", "honister", "kirkstone", "zeus", "langdale", "mickledore", "nanbield", "scarthgap", "styhead", "walnascar", "whinlatter"]'
+          default: '["master", "scarthgap", "whinlatter"]'
           required: true
 permissions:
   contents: read

.github/workflows/nightly-cve-check.yml

@@ -11,7 +11,7 @@ jobs:
   nightly-cve-check:
     runs-on: ubuntu-22.04
     steps:
-      - name: Install required packages to run nighly-cve-check
+      - name: Install required packages to run nightly-cve-check
         run: |
           sudo apt-get -y install gawk wget git diffstat unzip texinfo gcc build-essential chrpath socat cpio python3 xz-utils zstd liblz4-tool locales
           echo "en_US.UTF-8 UTF-8" | sudo tee --append /etc/locale.gen
@@ -38,18 +38,20 @@ jobs:
       - name: Run CVE check
         run: |
           source ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/init-build-env
-          echo 'INHERIT += "cve-check"' >> conf/local.conf
-          bitbake -c cve_check `find ${{ github.workspace }}/meta-aws -name *.bb -type f  | sed 's!.*/!!' | sed 's!.bb!!' | sed 's!_.*!!' | sort | uniq | sed -z 's/\n/ /g'`
-      - name: Show cve-summary.json
+          echo 'INHERIT += "create-spdx-3.0 sbom-cve-check-recipe"' >> conf/local.conf
+          bitbake -c sbom_cve_check_recipe `find ${{ github.workspace }}/meta-aws -name *.bb -type f  | sed 's!.*/!!' | sed 's!.bb!!' | sed 's!_.*!!' | sort | uniq | sed -z 's/\n/ /g'`
+      - name: Collect CVE results
+        if: '!cancelled()'
         run: |
-            cat ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json
-      - name: Check results (cve-summary.json) for unpatched CVEs
+          BUILD_DIR=~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build
+          find $BUILD_DIR/tmp/deploy/images/ -name "*.sbom-cve-check.yocto.json" -exec cat {} + | jq -s 'add' > cve-summary.json 2>/dev/null || echo '[]' > cve-summary.json
+          cat cve-summary.json
+      - name: Check results for unpatched CVEs
         shell: bash {0}
         run: |
-          # find unpatched cvs and always exit 0 to not fail the step, but store return value
-          jq  -e '.package[] | select(.issue[].status | contains ("Unpatched") )' ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json > cve-unpatched.json ; ret=$?; true
+          jq -e '.package[] | select(.issue[].status | contains ("Unpatched") )' cve-summary.json > cve-unpatched.json ; ret=$?; true
           if [ $ret -eq 0 ]; then
-            echo "::error::Found unpatched CVEs in packages: $(jq  -e '. | select(.issue[].status | contains ("Unpatched") ) | .name' cve-unpatched.json)"
+            echo "::error::Found unpatched CVEs in packages: $(jq -e '. | select(.issue[].status | contains ("Unpatched") ) | .name' cve-unpatched.json)"
             exit 1
           elif [ $ret -eq 4 ]; then
             echo "::notice::No unpatched CVEs found"
@@ -68,23 +70,23 @@ jobs:
             echo -e "# No unpatched CVE(s) found" >> $GITHUB_STEP_SUMMARY
           fi
           echo -e "# CVE-SUMMARY:\n" >> $GITHUB_STEP_SUMMARY
-          cat ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json >> $GITHUB_STEP_SUMMARY
+          cat cve-summary.json >> $GITHUB_STEP_SUMMARY
       - name: Save cve-summary.json
         if: '!cancelled()'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.4.0
         with:
           name: cve-summary.json
-          path: ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json
+          path: cve-summary.json
       - name: Save cve-summary
         if: '!cancelled()'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.4.0
         with:
           name: cve-summary
-          path: ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary
+          path: cve-summary.json
           if-no-files-found: ignore
       - name: Save cve-unpatched.json
         if: '!cancelled()'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.4.0
         with:
           name: cve-unpatched.json
           path: cve-unpatched.json

.github/workflows/pr-cve-check.yml

@@ -1,15 +1,62 @@
 name: pr-cve-check
 
-# DISABLED: cve-check.bbclass was removed from OE-core master (2026-03-31)
-# See https://github.com/aws4embeddedlinux/meta-aws/issues/15461
-# TODO: Migrate to sbom-cve-check
 on:
   workflow_dispatch:
+  pull_request:
+    branches:
+      - 'master-next'
+    paths:
+      - '**.bb'
+      - '**.inc'
 permissions:
   contents: read
 
 jobs:
+  changed:
+    name: Get changed recipes
+    runs-on: ubuntu-latest
+    outputs:
+      recipes: ${{ steps.recipes.outputs.recipes }}
+    steps:
+    - uses: actions/checkout@v4
+    - name: Get changed recipe names
+      id: recipes
+      env:
+        BASE_REF: ${{ github.base_ref }}
+        HEAD_REF: ${{ github.head_ref }}
+        HEAD_REPO_URL: ${{ github.event.pull_request.head.repo.clone_url }}
+        HEAD_REPO_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+        REPOSITORY: ${{ github.repository }}
+        HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      run: |
+        if [ -n "$BASE_REF" ] && [ -n "$HEAD_REF" ] && [ -n "$HEAD_SHA" ]; then
+          git fetch origin "$BASE_REF:$BASE_REF"
+
+          if [ "$HEAD_REPO_NAME" != "$REPOSITORY" ] && [ -n "$HEAD_REPO_URL" ]; then
+            git remote add fork "$HEAD_REPO_URL"
+            git fetch fork "$HEAD_REF"
+          else
+            git fetch origin "$HEAD_REF:$HEAD_REF"
+          fi
+
+          FORK_POINT=$(git merge-base "$BASE_REF" "$HEAD_SHA")
+          DIFF=$(git diff --name-only --diff-filter=d "$FORK_POINT" "$HEAD_SHA")
+        else
+          DIFF=""
+        fi
+
+        RECIPES=$(echo "$DIFF" | grep '\.bb$\|\.inc$' | sed 's!.*/!!' | sed 's!\.bb$!!' | sed 's!\.inc$!!' | sed 's!_.*!!' | sort | uniq | tr '\n' ' ')
+
+        if [ -z "$RECIPES" ]; then
+          echo "No changed recipes found"
+        else
+          echo "Changed recipes: $RECIPES"
+        fi
+        echo "recipes=$RECIPES" >> $GITHUB_OUTPUT
+
   pr-cve-check:
+    needs: changed
+    if: needs.changed.outputs.recipes != ''
     runs-on: ubuntu-22.04
     steps:
       - name: Install required packages to run cve-check
@@ -37,20 +84,26 @@ jobs:
             ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/downloads
           key: cache-cve-sstate-downloads
       - name: Run CVE check
+        env:
+          RECIPES: ${{ needs.changed.outputs.recipes }}
         run: |
           source ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/init-build-env
-          echo 'INHERIT += "cve-check"' >> conf/local.conf
-          bitbake -c cve_check `find ${{ github.workspace }}/meta-aws -name *.bb -type f  | sed 's!.*/!!' | sed 's!.bb!!' | sed 's!_.*!!' | sort | uniq | sed -z 's/\n/ /g'`
-      - name: Show cve-summary.json
+          echo 'INHERIT += "create-spdx-3.0 sbom-cve-check-recipe"' >> conf/local.conf
+          echo "Running CVE check on changed recipes: $RECIPES"
+          bitbake -c sbom_cve_check_recipe $RECIPES
+      - name: Collect CVE results
+        if: '!cancelled()'
         run: |
-            cat ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json
-      - name: Check results (cve-summary.json) for unpatched CVEs
+          BUILD_DIR=~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build
+          # Collect all yocto-format CVE check results
+          find $BUILD_DIR/tmp/deploy/images/ -name "*.sbom-cve-check.yocto.json" -exec cat {} + | jq -s 'add' > cve-summary.json 2>/dev/null || echo '[]' > cve-summary.json
+          cat cve-summary.json
+      - name: Check results for unpatched CVEs
         shell: bash {0}
         run: |
-          # find unpatched cvs and always exit 0 to not fail the step, but store return value
-          jq  -e '.package[] | select(.issue[].status | contains ("Unpatched") )' ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json > cve-unpatched.json ; ret=$?; true
+          jq -e '.package[] | select(.issue[].status | contains ("Unpatched") )' cve-summary.json > cve-unpatched.json ; ret=$?; true
           if [ $ret -eq 0 ]; then
-            echo "::error::Found unpatched CVEs in packages: $(jq  -e '. | select(.issue[].status | contains ("Unpatched") ) | .name' cve-unpatched.json)"
+            echo "::error::Found unpatched CVEs in packages: $(jq -e '. | select(.issue[].status | contains ("Unpatched") ) | .name' cve-unpatched.json)"
             exit 1
           elif [ $ret -eq 4 ]; then
             echo "::notice::No unpatched CVEs found"
@@ -69,20 +122,13 @@ jobs:
             echo -e "# No unpatched CVE(s) found" >> $GITHUB_STEP_SUMMARY
           fi
           echo -e "# CVE-SUMMARY:\n" >> $GITHUB_STEP_SUMMARY
-          cat ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json >> $GITHUB_STEP_SUMMARY
+          cat cve-summary.json >> $GITHUB_STEP_SUMMARY
       - name: Save cve-summary.json
         if: '!cancelled()'
         uses: actions/upload-artifact@v4.4.0
         with:
           name: cve-summary.json
-          path: ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary.json
-      - name: Save cve-summary
-        if: '!cancelled()'
-        uses: actions/upload-artifact@v4.4.0
-        with:
-          name: cve-summary
-          path: ~/bitbake-builds/poky-without-meta-aws-poky-distro_poky-altcfg-machine_qemux86-64/build/tmp/log/cve/cve-summary
-          if-no-files-found: ignore
+          path: cve-summary.json
       - name: Save cve-unpatched.json
         if: '!cancelled()'
         uses: actions/upload-artifact@v4.4.0

recipes-devtools/amazon-corretto/corretto-11-bin_11.0.30.7.1.bb → recipes-devtools/amazon-corretto/corretto-11-bin_11.0.31.11.1.bb

@@ -23,10 +23,10 @@ BASE:x86 = "amazon-corretto-${PV}-linux-x86"
 SRC_URI:x86 = "https://corretto.aws/downloads/resources/${PV}/amazon-corretto-${PV}-linux-x86.tar.gz;name=x86"
 
 # you can find checksum here: https://github.com/corretto/corretto-11/releases  since devtool upgrade can only do one arch atm.
-SRC_URI[x86-64.sha256sum] = "c4843d67b7c8f5f8ffbab43b90b8595243f48aa545b713e30e1d29a5f23b364c"
-SRC_URI[aarch64.sha256sum] = "16f7d0d23a232cd754f7d2e511efa85b369af55ef1eb0e4718e9e41aa9991ef6"
-SRC_URI[arm.sha256sum] = "8eddf8eee5626420ed871c546e533bbc79fba81413762655c3d3255648f6121e"
-SRC_URI[x86.sha256sum] = "a1cf80b537539cfe0186aecb7852602a742d6e2ca60815a39d88dda6035c4413"
+SRC_URI[x86-64.sha256sum] = "70f6ff3668f27d1052f9e26c7a00d601774a556a49e6e9e7faa9d510ae1d0dbe"
+SRC_URI[aarch64.sha256sum] = "8ee5fba821463363dc76a18049e338d12c74752430a743aa405af126a62218da"
+SRC_URI[arm.sha256sum] = "2a2253ec40e3c275fa29687382f7782ff0a421114385ec34a2df2e32fd17d634"
+SRC_URI[x86.sha256sum] = "7423a636ca1000688e874cdb961a507012f6eacb9cf42afc1273a7f279c61ada"
 
 # also available in master (not kirkstone) in classes-recipe: github-releases
 UPSTREAM_CHECK_REGEX ?= "releases/tag/v?(?P<pver>\d+(\.\d+)+)"

recipes-devtools/amazon-corretto/corretto-17-bin_17.0.18.9.1.bb → recipes-devtools/amazon-corretto/corretto-17-bin_17.0.19.10.1.bb

@@ -15,8 +15,8 @@ SRC_URI:append:aarch64 = " https://corretto.aws/downloads/resources/${PV}/amazon
 SRC_URI:append:x86-64 = " https://corretto.aws/downloads/resources/${PV}/amazon-corretto-${PV}-linux-x64.tar.gz;name=x86-64"
 
 # you can find checksum here: https://github.com/corretto/corretto-17/releases since devtool upgrade can only do one arch atm.
-SRC_URI[x86-64.sha256sum] = "87411b0792a0f2b8e0fef1178c012bfe338b5f5fedb8c1e7985213cb7f790428"
-SRC_URI[aarch64.sha256sum] = "dd6da079227bcc69894d01f256fe3397485d312122c9c7c14e43784cb5983924"
+SRC_URI[x86-64.sha256sum] = "d0f1b880445691425511c3aa62cb89889f03a71c2a43597a3df174fc01d3f3a0"
+SRC_URI[aarch64.sha256sum] = "1b9f75b5a2f740ab3305577858e2fc87dad827b60678d4573234d6357be59fa8"
 
 # also available in master (not kirkstone) in classes-recipe: github-releases
 UPSTREAM_CHECK_REGEX ?= "releases/tag/v?(?P<pver>\d+(\.\d+)+)"

recipes-devtools/amazon-corretto/corretto-21-bin_21.0.10.7.1.bb → recipes-devtools/amazon-corretto/corretto-21-bin_21.0.11.10.1.bb

@@ -15,8 +15,8 @@ SRC_URI:append:aarch64 = " https://corretto.aws/downloads/resources/${PV}/amazon
 SRC_URI:append:x86-64 = " https://corretto.aws/downloads/resources/${PV}/amazon-corretto-${PV}-linux-x64.tar.gz;name=x86-64"
 
 # you can find checksum here: https://github.com/corretto/corretto-21/releases since devtool upgrade can only do one arch atm.
-SRC_URI[x86-64.sha256sum] = "770f85bf2bbbb99dbe0248409e9424755d94dd6caf38fb9c1ef6434c4f650d48"
-SRC_URI[aarch64.sha256sum] = "f1e55ad92fcc8a9d15ea4ee3d2e395c5e649ba1b29e403be5b5580a62474bd27"
+SRC_URI[x86-64.sha256sum] = "5b4dc8817df13f88f9bfc434e5d018adb535889ff2fe0ccf758bcebcc216f394"
+SRC_URI[aarch64.sha256sum] = "bc419602d71d819bce147239fbdc48bfbc900fa1d60693537fb9a22bd6b86475"
 
 # also available in master (not kirkstone) in classes-recipe: github-releases
 UPSTREAM_CHECK_REGEX ?= "releases/tag/v?(?P<pver>\d+(\.\d+)+)"

recipes-devtools/amazon-corretto/corretto-25-bin_25.0.2.10.1.bb → recipes-devtools/amazon-corretto/corretto-25-bin_25.0.3.9.1.bb

@@ -15,8 +15,8 @@ SRC_URI:append:aarch64 = " https://corretto.aws/downloads/resources/${PV}/amazon
 SRC_URI:append:x86-64 = " https://corretto.aws/downloads/resources/${PV}/amazon-corretto-${PV}-linux-x64.tar.gz;name=x86-64"
 
 # you can find checksum here: https://github.com/corretto/corretto-25/releases since devtool upgrade can only do one arch atm.
-SRC_URI[x86-64.sha256sum] = "313e9921e573cf28a4876ab039d56b3a142e7b1b1e847b0dddd170b8dee80387"
-SRC_URI[aarch64.sha256sum] = "6e966b3c3609c25f40e29d6cdb81f83f52a3723c8196a4c38e0d5d03e463c4e5"
+SRC_URI[x86-64.sha256sum] = "00486fa402136f8d40512b101c645dd4db9be2b5535171530ad241cd96c1223d"
+SRC_URI[aarch64.sha256sum] = "8b1fd78bbd1f188f3884f580be674727174635252c0d4d6dfa7cd15de51879ce"
 
 # also available in master (not kirkstone) in classes-recipe: github-releases
 UPSTREAM_CHECK_REGEX ?= "releases/tag/v?(?P<pver>\d+(\.\d+)+)"

recipes-devtools/amazon-corretto/corretto-8-bin_8.482.08.1.bb → recipes-devtools/amazon-corretto/corretto-8-bin_8.492.09.1.bb

@@ -16,8 +16,8 @@ SRC_URI:x86-64 = "https://corretto.aws/downloads/resources/${PV}/amazon-corretto
 
 # you can find checksum here: https://github.com/corretto/corretto-8/releases since devtool upgrade can only do one arch atm.
 
-SRC_URI[x86-64.sha256sum] = "60ee7f2d1c2b48255793bc05fe5849b9c68669c0fb39eb117621955a2751192c"
-SRC_URI[aarch64.sha256sum] = "4ecbc18f6f3991c4ad26c82e5dd72804474b7bac439d34c325f32ebcdbcf3a9a"
+SRC_URI[x86-64.sha256sum] = "91dfffc5015ed1f3ecd548ec48cf5471fad5a7a52fcc9a41f53c4a0e96b08aad"
+SRC_URI[aarch64.sha256sum] = "fccd80cdb06d0257f2717158ae8db1b806a498473822bfd9d4b614d41e17e3e0"
 
 UPSTREAM_CHECK_URI = "https://github.com/corretto/corretto-8/tags"
 

recipes-devtools/python/python3-boto3_1.42.89.bb → recipes-devtools/python/python3-boto3_1.42.93.bb

@@ -12,7 +12,7 @@ SRC_URI = "\
     file://python_dependency_test.py \
     "
 
-SRCREV = "54a9dc1891d5e38110e5f77fc45fbc7e2e112bfe"
+SRCREV = "30acde73678f9eddb46f4a56a93dbc8e923210ff"
 
 inherit setuptools3 ptest
 

recipes-devtools/python/python3-botocore_1.42.89.bb → recipes-devtools/python/python3-botocore_1.42.93.bb

@@ -12,7 +12,7 @@ SRC_URI = "\
     file://python_dependency_test.py \
     "
 
-SRCREV = "9b76a624ae6311605797bc0b4cdc7c3e064c1593"
+SRCREV = "fd8b312610e48390c2a424cc2583f3174203b617"
 
 inherit setuptools3 ptest
 

recipes-iot/aws-iot-greengrass/greengrass-common.inc

@@ -1,4 +1,4 @@
 GG_BASENAME = "greengrass/v2"
 GG_ROOT = "${D}/${GG_BASENAME}"
 GG_CONFIG = "${GG_ROOT}/config"
-${GG_ROOT}/plugins = "${GG_ROOT}/plugins"
+GG_PLUGINS = "${GG_ROOT}/plugins"