[U-Boot] [ANN] U-Boot v2017.09 is released

11 Sep 2017


      Hey all,
I've released v2017.09 and it's now live on git and FTP and ACD (along
with PGP sig file).
There's a few things I need to headline in this release.  First and
foremost is https://www.kb.cert.org/vuls/id/166743 (aka CVE-2017-3225
and CVE-2017-3226).  If you're using CONFIG_ENV_AES in your project, you
have security implications to worry about and decide the correct path
forward in.  With respect to the community, I marked it as deprecated
for this release, and I plan to remove it for the next release unless
someone with relevant background steps up and wants to rewrite the code
in question (and make sure the rest of the environment code isn't going
to lead to other issues similar to CVE-2017-3226).  Both of the issues
in question here could be fixed but the worry is about it being the "tip
of the iceberg" in the area.
Second, if you make use of the 'env' build target (rather than
tools-all) you will need to update your logic as, due to moving the
environment code to an 'env' directory, the 'env' build target has been
renamed to 'envtools'.
Among the various features and bugfixes in this release we now have
support for NVMe devices.  We now also have "livetree" support in DM and
our EFI support continues to get more robust.
Please note that for v2017.11 the calendar again works out such that we
have up to -rc4 this time with planned releases on October 2nd, 16th,
30th, November 6th with release on November 13th.  Note that while for
this release I said I would be less strict about -rc2 contents, I think
that was a mistake and we should emphasize testing and regression
fixes/etc with our 'extra' release tag this time.  Finally, if anyone
has feedback about the release cycle time-lines, please feel free to
reach out to me, in public or in private, with good or bad news.
Thanks again everyone!
-- 
Tom

Tom Rini

Wolfgang Denk

tags (0)

participants (2)