From 56aa1647084732966134eafacb04ea4d0c79aa18 Mon Sep 17 00:00:00 2001 From: ScottW514 Date: Thu, 15 Oct 2026 13:57:52 -0400 Subject: [PATCH] Pin forgeext 0.1.4 on the pushed head - forgeext e09f7b8 -> bb75b23 (0.1.3 -> 0.1.4): sandbox_test opens the machine's own files from inside the sandbox - /dev/glowforge, /data/forgefirm/forgefirm.conf, /data/forgefirm/setup.json - and requires EACCES of each (ENOENT is no pass; a file the host lacks is made for the run, readable by every account, and removed after). Test-only; nothing the image installs changes. Proof: forgeext's CI run on bb75b23 (38780750106) is green on a kernel with Landlock ABI 7; its log shows the three files made for the run and each open refused with EACCES (sandbox_test, 0 failures). bitbake -c fetch forgeext from this pin succeeds (2 tasks). --- meta-forgefirm/recipes-forgefirm/forgeext/forgeext-pin.inc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/meta-forgefirm/recipes-forgefirm/forgeext/forgeext-pin.inc b/meta-forgefirm/recipes-forgefirm/forgeext/forgeext-pin.inc index a9dcdf1..3b64273 100644 --- a/meta-forgefirm/recipes-forgefirm/forgeext/forgeext-pin.inc +++ b/meta-forgefirm/recipes-forgefirm/forgeext/forgeext-pin.inc @@ -4,5 +4,5 @@ # only SRCREV and PV here - the image manifest leaves *-pin.inc out of the # layer content hash because the component entry already identifies the # pinned source (forgefirm-image-manifest.bbclass). -SRCREV = "e09f7b8060af995b0ea5d2c5bfa1d23f00636261" -PV = "0.1.3" +SRCREV = "bb75b23088b6ecce502ee3122bfb089b1c2641f1" +PV = "0.1.4"