NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
876917689b
kumquat-buildroot/package/glibc/glibc.hash

9 lines
590 B
Plaintext
Raw Normal View History

package/glibc: switch to using the maintenance branch glibc upstream has ruled against doing regular point-releases, but they do have a lot of interesting and important fixes for regressions and security. Backporting each patch, or cherry-picking individual patches is off limits for us, so we just switch to using the currently-latest HEAD of the maintenance branch instead. The version number is obtained with: $ git describe --match 'glibc-*' --abbrev=40 origin/release/2.26/master The alternative options were: - download the tarball from the git tree --> does not work; not an option - download the 2.26 tarball, and bundle the individual patches in Buildroot --> maintenance of patches is a burden; not an option - download the 2.26 tarball, maintain the list of patches to download from the git tree --> not an option for the same reason So we end up just doing a git clone. The git tree is today about ten times the size of the tarball, so a rough estimate makes it at about ten times the download time. Also upstream doesn't officially provide an https download location [1]. There is one but it's not reliable, sometimes the connection time out and end-up with a corrupted git repo: fatal: unable to access 'https://sourceware.org/git/glibc.git/': Failed to connect to sourceware.org port 443: Connection timed out So switch to using a git mirror from github which is updated once a day [2]. This allow at the same time to clone the git repository faster. Note: The glibc 2.26 patches are not kept for the arc toolchain since they are fixing an issue with the new float128 support introduced in x86, x86_64 and powerpc64le. [1] https://sourceware.org/git/?p=glibc.git;a=summary [2] https://github.com/bminor/glibc.git Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Romain Naour <romain.naour@openwide.fr> Cc: Peter Korsgaard <peter@korsgaard.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: Arnout Vandecappelle <arnout@mind.be> Cc: Evgeniy Didin <didin@synopsys.com> CC: Alexey Brodkin <abrodkin@synopsys.com> [Romain: bump 4b692dffb95ac4812b161eb6a16113d7e824982e] Signed-off-by: Romain Naour <romain.naour@gmail.com> [yann.morin.1998@free.fr: update comment to never decide on the mirror] Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Reviewed-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-10-29 10:52:48 +01:00
# Locally calculated (fetched from Github)
glibc: security bump to latest 2.27 branch Fixed issues are listed in the 2.27 branch NEWS file: CVE-2017-18269: An SSE2-based memmove implementation for the i386 architecture could corrupt memory. Reported by Max Horn. CVE-2018-11236: Very long pathname arguments to realpath function could result in an integer overflow and buffer overflow. Reported by Alexey Izbyshev. CVE-2018-11237: The mempcpy implementation for the Intel Xeon Phi architecture could write beyond the target buffer, resulting in a buffer overflow. Reported by Andreas Schwab. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-05-29 16:37:54 +02:00
sha256 33189b3f10c88730a1f686fac794bc01f31765f12ffd75bc5e8a0f2a690d217a glibc-glibc-2.27-57-g6c99e37f6fb640a50a3113b2dbee5d5389843c1e.tar.gz
toolchain: add glibc support for ARCv2 Finally there's working ARC port of glibc thanks to Vineet and Cuper! This port is based on pretty recent glibc's master branch and ARC changes are being reviewed now in glibc's mailing list. Thus we again have to use sources from our GitHub but as soon as there's a glibc release with our patches applied we'll switch to upstream releases and will drop our glibc GitHub repo alltogether. Note now we cut tags in glibc repo simultaneously with tags in Binutils and GCC repos and so to make sure everything works in the best way we plan to update glibc tag together with Binutils and GCC. Also note as of today ARCompact (AKA ARCv1 ISA) is not supported in glibc but we plan to fix it soonish so for now we make glibc intentionally dependent on archs38. Also note we are not creating directory "2.26" because all patches for glibc ver 2.26 applies to arc glibc port. Signed-off-by: Evgeniy Didin <didin@synopsys.com> CC: Alexey Brodkin <abrodkin@synopsys.com> CC: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> CC: Waldemar Brodkorb <wbx@openadk.org> CC: Romain Naour <romain.naour@gmail.com> Cc: Cupertino Miranda <cmiranda@synopsys.com> Cc: Vineet Gupta <vgupta@synopsys.com> Cc: Anton Kolesov <akolesov@synopsys.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
2017-10-10 15:31:50 +02:00
# Locally calculated (fetched from Github)
toolchain: Bump ARC tools to arc-2018.03-rc2 This commit bumps ARC toolchain to arc-2018.03-rc2, which includes significant changes since arc-2018.03-rc1. We want to test how new toolchain-rc2 builds packages, so we can make fixes before release of toolcain. This makes us closer to toolchain release which will be in a few weeks. Please note that it is a release candidate and it might contain some breakages, please don't use it for production builds. Signed-off-by: Evgeniy Didin <didin@synopsys.com> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Cc: arc-buildroot@synopsys.com Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 7aaabe8fc04006b15bb5f9aaf08ac07603fcf7fe) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-05-25 20:07:01 +02:00
sha256 ddc63360393ab88ab6a4a0c81d33481f34c5a9ebd758eec2e6bb35385058b4cb glibc-arc-2018.03-rc2.tar.gz
package/glibc: security bump to 2.27 See: https://sourceware.org/ml/libc-announce/2018/msg00000.html https://sourceware.org/glibc/wiki/Release/2.27 Fixes the following CVEs: CVE-2017-1000408 CVE-2017-1000409 CVE-2017-16997 CVE-2018-1000001 CVE-2018-6485 While at it, add license file hashes. Signed-off-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-05 21:57:16 +01:00
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 COPYING
sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING.LIB
sha256 61abdd6930c9c599062d89e916b3e7968783879b6be0ee1c6229dd6169def431 LICENSES
Reference in New Issue Copy Permalink