NetCube-Systems-Austria/kumquat-buildroot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
fe6aa1f5c9
kumquat-buildroot/package/libgit2/libgit2.mk

48 lines
1.4 KiB
Makefile
Raw Normal View History

libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-14 12:13:51 +01:00
################################################################################
#
# libgit2
#
################################################################################
package/libgit2: bump version to 1.4.3 git added restrictions on config files to fix CVE 2022-24765. libgit2 adopted these changes for compatibility reasons, even if the vuln is not exploitable in libgit2. https://github.com/libgit2/libgit2/releases/tag/v1.4.3 Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-04-27 09:22:45 +02:00
LIBGIT2_VERSION = 1.4.3
package/libgit2: bump to version 1.2.0 COPYING was updated with a copy of the openssl licence since libgit2 now include openssl headers so it can dlopen it: openssl: dynamically load libssl and symbols (optionally) Provide an interface around OpenSSL to dynamically load the libraries and symbols, so that users can distribute a libgit2 library that is not linked directly against OpenSSL. This enables users to target multiple distributions with a single binary. This mechanism is optional and disabled by default. Configure cmake with -DUSE_HTTPS=OpenSSL-Dynamic to use it. We do not use that option so the headers are not even used, plus the headers are not installed on the target anyway, so this patch includes no license changes. Upstream also stopped providing release tarballs, relying on github-generated tarballs instead. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-09-08 15:30:09 +02:00
LIBGIT2_SITE = $(call github,libgit2,libgit2,v$(LIBGIT2_VERSION))
package/libgit2: bump version to 1.4.2 Licence changes mostly concern vendored dependencies (that buildroot does not use) and a new bundled PRNG used to reimplement mkstemp() - added CC0 license for that. Some buildsystem options also changed: - THREADSAFE is now USE_THREADS - BUILD_CLAR is now BUILD_TESTS, which the cmake infra already give. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-02-28 09:57:00 +01:00
LIBGIT2_LICENSE = GPL-2.0 with linking exception, MIT (sha1), wildmatch license (wildmatch), CC0-1.0 (xoroshiro256)
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-14 12:13:51 +01:00
LIBGIT2_LICENSE_FILES = COPYING
package: drop _CPE_ID_VALID, use _CPE_ID_VENDOR FOO_CPE_ID_VALID really ought to be an internal implementaion detail. Packages that really want to trigger their CPE defintitions really should set one of the actual variables to a meaningful value. There are two CPE-related variables that we could chose to set to replace FOO_CPE_ID_VALID: FOO_CPE_ID_VENDOR and FOO_CPE_ID_PRODUCT. Between those two, _VENDOR more often diverges from the default than _PRODUCT does, so that's what we use. ---8<------8<------8<------8<------8<--- #!/bin/bash # Replace FOO_CPE_ID_VALID = YES with FOO_CPE_ID_VENDOR = foo_project for i in $(git grep -l -E '[^)]_CPE_ID_VALID = YES' package support); do pkg="$(basename "${i%/*}")" sed -r -i -e "s/_CPE_ID_VALID = YES/_CPE_ID_VENDOR = ${pkg}_project/" "${i}" done ---8<------8<------8<------8<------8<--- Reported-by: Peter Korsgaard <peter@korsgaard.com> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr> Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com> Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be> Cc: Matthew Weber <matthew.weber@rockwellcollins.com> Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com> [Peter: update cpe-test comment to reflect pkg3 change] Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-03-05 23:27:44 +01:00
LIBGIT2_CPE_ID_VENDOR = libgit2_project
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-14 12:13:51 +01:00
LIBGIT2_INSTALL_STAGING = YES
LIBGIT2_CONF_OPTS = \
-DUSE_GSSAPI=OFF \
-DUSE_ICONV=ON \
package/libgit2: Bump to version 1.0.0 This version changes the required dependencies as well as introducing new bundled ones... - Switch to the tarball released by upstream. - Start depending on httpparser, instead of using the bundled one. - Force using regcomp instead of using a bundled pcre. - Add license for a bundled wildmatch and sha1. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [yann.morin.1998@free.fr: reorder licenses; two spaces in hash file.] Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-04-17 09:28:01 +02:00
-DREGEX_BACKEND=regcomp \
-DUSE_HTTP_PARSER=system \
package/libgit2: disable NTLM support unconditionally. NTLM is an old authentication protocol depending on DES and MD4 and its creator, Microsoft, discourage its use since 2010, because it is weak and vulnerable to many attacks. libgit2 has support for NTLM and it is enabled by default if openssl is used, however, since commit a83d41867c8d ("package/libopenssl: add option to enable some features"), support for DES and MD4 can be disabled in openssl. Since openssl is an optional dependency to libgit2 and getting rid of NTLM is a goal in itself for many windows administrators, disable NTLM by default. Fixes: http://autobuild.buildroot.net/results/efb4ce2174cb6944558e895ce852182ba2738a70 Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-05-24 19:33:10 +02:00
-DUSE_NTLMCLIENT=OFF \
package/libgit2: bump version to 1.4.2 Licence changes mostly concern vendored dependencies (that buildroot does not use) and a new bundled PRNG used to reimplement mkstemp() - added CC0 license for that. Some buildsystem options also changed: - THREADSAFE is now USE_THREADS - BUILD_CLAR is now BUILD_TESTS, which the cmake infra already give. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2022-02-28 09:57:00 +01:00
-DUSE_THREADS=$(if $(BR2_TOOLCHAIN_HAS_THREADS),ON,OFF)
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-14 12:13:51 +01:00
package/libgit2: Bump to version 1.0.0 This version changes the required dependencies as well as introducing new bundled ones... - Switch to the tarball released by upstream. - Start depending on httpparser, instead of using the bundled one. - Force using regcomp instead of using a bundled pcre. - Add license for a bundled wildmatch and sha1. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [yann.morin.1998@free.fr: reorder licenses; two spaces in hash file.] Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-04-17 09:28:01 +02:00
LIBGIT2_DEPENDENCIES = zlib libhttpparser
libgit2: do not use a bundled zlib libgit2 depends on zlib. If libgit2's build system does not find a system zlib, then it compiles a bundled version of it, which is not really great. So instead, add zlib as a mandatory dependency. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-06-01 17:41:58 +02:00
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-14 12:13:51 +01:00
# If libiconv is available (for !locale toolchains), then we can use
# it for iconv support. Note that USE_ICONV=ON is still correct even
# without libiconv because (1) most toolchain have iconv support
# without libiconv and (2) even if USE_ICONV=ON but iconv support is
# not available, libgit2 simply avoids using iconv.
ifeq ($(BR2_PACKAGE_LIBICONV),y)
LIBGIT2_DEPENDENCIES += libiconv
endif
ifeq ($(BR2_PACKAGE_LIBSSH2),y)
LIBGIT2_DEPENDENCIES += libssh2
LIBGIT2_CONF_OPTS += -DUSE_SSH=ON
else
LIBGIT2_CONF_OPTS += -DUSE_SSH=OFF
endif
ifeq ($(BR2_PACKAGE_OPENSSL),y)
LIBGIT2_DEPENDENCIES += openssl
libgit2: bump version to 0.27.1 Fixes a security vulnerability similar to git's CVE-2018-11235 This release changes some configuration options, so tweak them accordingly. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-06-01 17:41:59 +02:00
LIBGIT2_CONF_OPTS += -DUSE_HTTPS=OpenSSL
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-14 12:13:51 +01:00
else
libgit2: bump version to 0.27.1 Fixes a security vulnerability similar to git's CVE-2018-11235 This release changes some configuration options, so tweak them accordingly. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-06-01 17:41:59 +02:00
LIBGIT2_CONF_OPTS += -DUSE_HTTPS=OFF
libgit2: new package Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> [Thomas: - Do not select BR2_PACKAGE_ZLIB, because zlib is an optional dependency. - Handle optional dependencies in a more usual way in libgit2.mk: group the addition in _DEPENDENCIES and in _CONF_OPTS for a given library together. - libgit2 can optionally use libssh2, not libssh. - Add the optional dependency on zlib. - Always pass USE_ICONV=ON, the detection works perfectly fine, with both a C library providing iconv support built-in, and with libiconv. If neither provides iconv, it gets disabled automatically as expected. - Add libiconv as an optional dependency.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2018-02-14 12:13:51 +01:00
endif
$(eval $(cmake-package))
Reference in New Issue Copy Permalink