How big of a problem are Un-upstreamed patches
summary
Yocto/OpenEmbedded shows concrete counts: 200 backports, 253 pending, 452 inappropriate, 232 submitted, 19 denied, 21 inactive and 69 CVE-related patches, with a long tail including 13-year-old pending patches; overall pending counts fall from ~2,000 to ~1,700 over time. Buildroot has ~1,600 patches with only 35 marked upstream and some patches edited up to 14 times. Fedora source analysis is noisy (36 packages: 13 CVEs, 2 upstream statuses). Practical fixes: require upstream-status metadata, use git-format-patch and prefer backports that vanish on rebase.
AI-written summary · about
chapters (9)
- 0:00Introduction to un-upstreamed patches
- 1:27Why upstreaming matters
- 4:17Drive-by patches explained
- 8:19Real-world patching failure
- 10:08OpenEmbedded patch analysis
- 19:24Patch age and pending status
- 23:39Buildroot and Fedora comparison
- 29:35Solutions and best practices
- 31:41Q&A and wrap-up
related talks
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
37mHow to Serve Open Source Maintainers Without Annoying Them?
31mWhat to Do When the Bug Is in Someone Else's Code
44mOpen Source Practice of LG Electronics
50mDo our development tools need a refresh?
43mReducing Ratio of Reserved But Public CVEs
25mHow the magic of open source helps our project
40mBoF: The Yocto Project and OpenEmbedded