NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
223085f671
kumquat-buildroot/package/cpio/cpio.mk

27 lines
764 B
Makefile
Raw Normal View History

cpio: new package Adding the cpio archive utility for the target and host. Patches have been pulled from ArchLinux and Gentoo to fix CVE issues and compile issues. [Thomas: remove host variant of the package, as discussed during the review of earlier version.] Signed-off-by: Clayton Shotwell <clayton.shotwell@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-14 22:20:26 +02:00
################################################################################
#
# cpio
#
################################################################################
package/cpio: security bump to version 2.13 Removed patch fixing CVE-2016-2037 which was applied upstream. This release fixes CVE-2015-1197, CVE-2016-2037, CVE-2019-14866. Switched to .bz2 tarball. Added hashes provided by upstream and license hash. Release notes: https://lists.gnu.org/archive/html/info-gnu/2019-11/msg00002.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-04 21:18:37 +01:00
CPIO_VERSION = 2.13
CPIO_SOURCE = cpio-$(CPIO_VERSION).tar.bz2
package/cpio: Fix GNU Mirror Path Replacing ftpmirror.gnu.org with BR2_GNU_MIRROR variable Signed-off-by: Brian 'redbeard' Harrington <redbeard@coreos.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-02-06 17:49:25 +01:00
CPIO_SITE = $(BR2_GNU_MIRROR)/cpio
cpio: install to /bin and after busybox As the usual rule consider full-blown packages superior to busybox, hence build after it. Also install cpio to /bin to override the busybox-provided one. Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2015-10-02 15:43:49 +02:00
CPIO_CONF_OPTS = --bindir=/bin
boot, package: use SPDX short identifier for GPLv3/GPLv3+ We want to use SPDX identifier for license string as much as possible. SPDX short identifier for GPLv3/GPLv3+ is GPL-3.0/GPL-3.0+. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/\<GPLv3\>/GPL-3.0/g' Signed-off-by: Rahul Bedarkar <rahulbedarkar89@gmail.com> Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-03-30 15:43:33 +02:00
CPIO_LICENSE = GPL-3.0+
cpio: new package Adding the cpio archive utility for the target and host. Patches have been pulled from ArchLinux and Gentoo to fix CVE issues and compile issues. [Thomas: remove host variant of the package, as discussed during the review of earlier version.] Signed-off-by: Clayton Shotwell <clayton.shotwell@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-14 22:20:26 +02:00
CPIO_LICENSE_FILES = COPYING
package/cpio: add CPIO_CPE_ID_VENDOR cpe:2.3:a:gnu:cpio is a valid CPE identifier for this package: https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Acpio Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-01-17 17:46:49 +01:00
CPIO_CPE_ID_VENDOR = gnu
cpio: new package Adding the cpio archive utility for the target and host. Patches have been pulled from ArchLinux and Gentoo to fix CVE issues and compile issues. [Thomas: remove host variant of the package, as discussed during the review of earlier version.] Signed-off-by: Clayton Shotwell <clayton.shotwell@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-14 22:20:26 +02:00
package/cpio: fix CVE-2021-38185 GNU cpio through 2.13 allows attackers to execute arbitrary code via a crafted pattern file, because of a dstring.c ds_fgetstr integer overflow that triggers an out-of-bounds heap write. NOTE: it is unclear whether there are common cases where the pattern file, associated with the -E option, is untrusted data. Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-08-19 23:46:09 +02:00
# 0002-Rewrite-dynamic-string-support.patch
# 0003-Fix-previous-commit.patch
CPIO_IGNORE_CVES += CVE-2021-38185
package/cpio: add argp-standalone dependency with musl Since argp-standalone is only available for uClibc-ng and musl toolchains, add the dependendy only if it's selected. Signed-off-by: Romain Naour <romain.naour@openwide.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-08-08 00:47:16 +02:00
# cpio uses argp.h which is not provided by uclibc or musl by default.
package/cpio: remove useless comment This comment is about host-cpio which hasn't been added in Buildroot. Signed-off-by: Romain Naour <romain.naour@openwide.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-08-08 00:47:17 +02:00
# Use the argp-standalone package to provide this.
package/cpio: add argp-standalone dependency with musl Since argp-standalone is only available for uClibc-ng and musl toolchains, add the dependendy only if it's selected. Signed-off-by: Romain Naour <romain.naour@openwide.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-08-08 00:47:16 +02:00
ifeq ($(BR2_PACKAGE_ARGP_STANDALONE),y)
cpio: new package Adding the cpio archive utility for the target and host. Patches have been pulled from ArchLinux and Gentoo to fix CVE issues and compile issues. [Thomas: remove host variant of the package, as discussed during the review of earlier version.] Signed-off-by: Clayton Shotwell <clayton.shotwell@rockwellcollins.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2015-07-14 22:20:26 +02:00
CPIO_DEPENDENCIES += argp-standalone
endif
$(eval $(autotools-package))
package/cpio: add host version The latest cpio has a --reproducible option, which may come handy when we try to, well, be reproducible... Reported-by: Arnout Vandecappelle <arnout@mind.be> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> [Atharva: don't force --bindir, as noticed by Arnout] Signed-off-by: Atharva Lele <itsatharva@gmail.com> Acked-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Arnout Vandecappelle <arnout@mind.be> Cc: Atharva Lele <itsatharva@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-07-16 19:35:17 +02:00
$(eval $(host-autotools-package))
Reference in New Issue Copy Permalink