During this release we had a CVE fix go in but the commit only added the patch but didn't add the patch to SRC_URI in order to ensure it got applied: http://git.yoctoproject.org/cgit/cgit.cgi/poky/commit/?id=3a769fce06180012803da863598b03e611227783 It does appear that this was a mistake in the original submission rather than something that happened between the submission and the patch merging. We need to detect where a patch file is being added but no corresponding change to a SRC_URI value is being made in a recipe or an inc file.
Moving to M4 waiting for an execution error (bitbake/tinfoil related) to be solved.
Moving to 2.5 M1, I'll work on enhancements on such milestone.
Merged at: https://git.yoctoproject.org/cgit/cgit.cgi/patchtest-oe/commit/?id=49201c19cfe4cadd127b112d2858d5b28db49c20
There was a false positive thus commit was reverted.
*** Bug 11601 has been marked as a duplicate of this bug. ***
Duplicate and Changqing Li has fix for 13005. *** This bug has been marked as a duplicate of bug 13005 ***