Commit Graph

68911 Commits

Author SHA1 Message Date
Daniel Lang
15639f4299 utils/getdeveloperlib.py: handle file removal
If a patch only removes files, it is ignored. Meaning, that the
registered developer isn't automatically picked up when calling
get-developer.
Fix this by also checking if the line starts with ---, as a patch
removing a file has a line starting with --- with the name of the
removed file and one started with +++ /dev/null.
A set is used to store the changed files, which doesn't allow
duplicates. Therefore normal patches aren't affected by this change.

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7bc5ea80c7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-15 19:50:24 +02:00
Julien Olivain
1c6e9cd37f package/zynaddsubfx: fix build with gcc 13
When compiling with gcc 13, build fails with errors, such as:

    In file included from /build/zynaddsubfx-3.0.6/src/Nio/NulEngine.h:21,
                     from /build/zynaddsubfx-3.0.6/src/Nio/NulEngine.cpp:14:
    /build/zynaddsubfx-3.0.6/src/Nio/MidiIn.h:37:9: error: 'uint8_t' does not name a type
       37 |         uint8_t midiSysEx(unsigned char data);
          |         ^~~~~~~

Those gcc 13 changes were announced at:
https://gcc.gnu.org/gcc-13/porting_to.html#header-dep-changes

This commit fixes the issue by adding upstream patches, not yet
included in a release.

Fixes:
http://autobuild.buildroot.net/results/97b5a30c7be820ac91e745cf60f9b759e962aa5c

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 56e7ca5dbc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-15 19:38:58 +02:00
Maxim Kochetkov
995a61e958 package/timescaledb: bump version to 2.11.2
Release notes: https://github.com/timescale/timescaledb/blob/2.11.2/CHANGELOG.md

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b0f2709e6f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:08:47 +02:00
Daniel Lang
6fb61f11b7 package/libiec61850: ignore CVE-2023-27772
Segmentation fault in example code can be exploited.
BUILD_EXAMPLES is disabled for all cmake projects.

See https://github.com/mz-automation/libiec61850/issues/442

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b25f1cb47c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:05:17 +02:00
Frank Hunleth
73554da86f package/erlang: support building on aarch64
Erlang has good support for aarch64 hosts, and this allows it to be
built without a warning.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 54b6eced24)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:02:55 +02:00
Christian Stewart
999cf19465 package/conmon: bump version to 2.1.8
Bug fixes.

https://github.com/containers/conmon/releases/tag/v2.1.8

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f862a1abf1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:01:02 +02:00
Adam Duskett
37b44df9af package/php: bump version to 8.2.10
Signed-off-by: Adam Duskett <aduskett@gmail.comm>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9bf196ce28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:57:57 +02:00
Christian Stewart
2b72f1d167 package/go: security bump to version 1.20.8
go1.20.8 (released 2023-09-06) includes two security fixes to the html/template
package, as well as bug fixes to the compiler, the go command, the runtime, and
the crypto/tls, go/types, net/http, and path/filepath packages.

CVE-2023-39318: html/template: improper handling of HTML-like comments within script contexts
CVE-2023-39319: html/template: improper handling of special tags within script contexts
CVE-2023-39321: crypto/tls: panic when processing post-handshake message on QUIC connections

https://go.dev/doc/devel/release#go1.20.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:21:23 +02:00
Stefan Agner
4fd72a713a package/docker-cli: bump version to v24.0.6
Bug fixes in containerd storage backend and Docker itself and a single
new warning about old Docker image format deprecation.

https://github.com/moby/moby/releases/tag/v24.0.6

Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9204d644a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:20:19 +02:00
Stefan Agner
c4a7dee1c2 package/docker-engine: bump version to v24.0.6
Bug fixes in containerd storage backend and Docker itself and a single
new warning about old Docker image format deprecation.

https://github.com/moby/moby/releases/tag/v24.0.6

Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4e80116562)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:20:12 +02:00
Peter Korsgaard
d8ce1deff9 Update for 2023.08
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-06 21:54:35 +02:00
Julien Olivain
79c7a67a4c package/dt: fix Kconfig package URL
The old package URL is no longer working. This commit updates it to
the one advertised at [1].

[1] b30eb7a123/html/dt.html (L33)

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-06 21:20:13 +02:00
Adam Duskett
0ef48995a1 package/zeromq: Fix building against gcc-13
`gcc-13` added an assert to standard headers to make sure custom
allocators have intended implementation of rebind type instead
of inherited rebind. gcc change:
https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=64c986b49558a7

Taken from upstream commit bdd471fa17100fe84f64da348951dab3ee4780bb

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-06 21:18:10 +02:00
Francois Perrad
b7488b4d68 package/libtommath: security bump to version 1.2.1
This is a bugfix release only containing the fix to a potential integer underflow
which got assigned CVE-2023-36328.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-05 15:24:38 +02:00
Thomas Petazzoni
19921699b3 package/pixman: ignore CVE-2023-37769
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:42:15 +02:00
Thomas Petazzoni
a9c74c5b7f package/python-ipython: ignore CVE-2023-24816
It affects only Windows, so we don't care in the context of Buildroot.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:34:07 +02:00
Thomas Petazzoni
317c4b8f60 package/python-tornado: backport fix for CVE-2023-28370
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:33:37 +02:00
Thomas Petazzoni
57229c22f1 package/python-pip: ignore CVE-2018-20225
See https://security-tracker.debian.org/tracker/CVE-2018-20225 for the
rationale of ignoring this CVE. Things basically work as intended.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:32:56 +02:00
Thomas Petazzoni
2397349fa9 package/python-django: security bump to 4.1.10
4.1.9 is affected by CVE-2023-36053, and 4.1.10 was released to fix
it. The changes between 4.1.9 and 4.1.10 are just:

f9a14b8f0668029fb7e0aebcae57b60dcec4a529 (tag: 4.1.10) [4.1.x] Bumped version for 4.1.10 release.
beb3f3d55940d9aa7198bf9d424ab74e873aec3d [4.1.x] Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and URLValidator.
3b48fe413f91612fb8c43fe9d489860d10c84bf7 [4.1.x] Added stub release notes for 4.1.10 and 3.2.20.
0e5948b8df5d25deb48a505cbf16f010d9dc603c [4.1.x] Fixed MultipleFileFieldTest.test_file_multiple_validation() test if Pillow isn't installed.
66e1e9b006618ba00e804d18bd90d3a9e94801b3 [4.1.x] Added CVE-2023-31047 to security archive.
d1385cc51b142b05b21b721d9d68fc461bc7241f [4.1.x] Post-release version bump.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:32:03 +02:00
Thomas Petazzoni
f3ab33c62f package/poppler: bump version to latest in 22.x series
This commit updates poppler to the latest version in the 22.x series,
with only has bug fixes. Here is the list of commits between 22.10.0
and 22.12.0:

df568263c51950ceed6f1fb42f80e99a2614c275 (tag: poppler-22.12.0) poppler 22.12.0
198dc1d0674c0a462668e6868c35b1ee0e731005 Form::addFontToDefaultResources: Be stubborn in finding a font we can use
a5952ab70716a2d4f792a943c2dcf3068f1d6885 Revert "CI: Fix Debian brokenness"
8fcaa7c622d24761a9ecb3922f95d072077d6f34 CI: Fix Debian brokenness
cc665f757af6b87dd245d36e079dd44d8d2d2182 (tag: poppler-22.11.0) poppler 22.11.0
a296982e1d5b4968b2bd044d80647ae6f9267526 Do not include a poppler/ file from a splash/ header
bc4a0d9a2abfcd75d9b0ee4be3f7600905fe6001 Form: Provide Unicode marker when ensuring fonts
111f38a722eedddd94faa52dda8c5e0da561fb41 Cairo: Update font after restore
907d05a6a141284aee22fbd16ab0a2fb4e0f2724 Fix crash in file that wants to do huge transparency group
e53f5aae3bce7d09788f2ad62be998895fb9807b PSOutputDev::setupResources: Fix stack overflow in malformed doc
a4ca3a96a6b1f65b335a1ea362e6c202e46ae055 topIdx can't be negative
e471f8e09bf2e38df0cf5df1acecbcca70685573 Init all the fields of JPXStreamPrivate
5190c0d4369bd9f501922585140be4ec736e24f2 No need to store smaskInData in priv
6263bb90b09326103b10e4c4edfbc5b84c884921 Page label ranges can't start in < 0

Note: this version bump does not include the fix for CVE-2023-34872,
so we still need the backported patch.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:31:02 +02:00
Thomas Petazzoni
fea8852c68 package/poppler: backport patch to fix CVE-2023-34872
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:29:48 +02:00
Bernd Kuhls
7ec2df1e9a package/mesa3d-demos: add dependency on libdecor for wayland support
libdecor cannot be selected due to a circular dependency:

package/wayland/Config.in:1:error: recursive dependency detected!
package/wayland/Config.in:1: symbol BR2_PACKAGE_WAYLAND is selected by BR2_PACKAGE_LIBDECOR
package/libdecor/Config.in:1: symbol BR2_PACKAGE_LIBDECOR is selected by BR2_PACKAGE_MESA3D_DEMOS
package/mesa3d-demos/Config.in:1: symbol BR2_PACKAGE_MESA3D_DEMOS is selected by BR2_PACKAGE_PIGLIT
package/piglit/Config.in:1: symbol BR2_PACKAGE_PIGLIT depends on BR2_PACKAGE_WAFFLE_SUPPORTS_WAYLAND
package/waffle/Config.in:7: symbol BR2_PACKAGE_WAFFLE_SUPPORTS_WAYLAND depends on BR2_PACKAGE_WAYLAND

Without libdecor, the build fails since the bump of mesa3d-demos to
version 9.0.0 in 80304d9911:

"""
Run-time dependency libdecor-0 found: NO (tried pkgconfig and cmake)
Looking for a fallback subproject for the dependency libdecor-0
../output-1/build/mesa3d-demos-9.0.0/meson.build:88:17: ERROR: Automatic wrap-based subproject downloading is disabled
"""

Fixes:

  http://autobuild.buildroot.net/results/8de50be8233f0133aadc26bda71b48d7ec329e04/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 19:12:16 +02:00
Bernd Kuhls
cb4e9360b4 package/libdecor: new package
Needed for wayland support in mesa3d-demos.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Sebastian Weyer <sebastian.weyer@smile.fr>
Tested-by: Sebastian Weyer <sebastian.weyer@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 19:09:25 +02:00
Bernd Kuhls
84b0d834a4 package/mesa3d-demos: add dependency on libxkbcommon for wayland support
Since the bump of mesa3d-demos to version 9.0.0 in Buildroot commit
80304d9911, libxkbcommon is needed for
the wayland support. Without libxkbcommon, the build fails with:

Run-time dependency wayland-client, wayland-egl, xkbcommon found: NO (tried pkgconfig and cmake)

../output-1/build/mesa3d-demos-9.0.0/meson.build:62:14: ERROR: Dependency "wayland-client, wayland-egl, xkbcommon" not found, tried pkgconfig and cmake

Fixes:

  http://autobuild.buildroot.net/results/1c01da4966b054de9c15f0eb3d738806c7d5d315/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Thomas: patch extracted from
https://patchwork.ozlabs.org/project/buildroot/patch/20230716145003.339645-2-bernd@kuhls.net/]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 19:09:25 +02:00
Romain Naour
39ae14faab package/mesa3d-demos: update optional opengl patch due to new glu dependency in util
matrix-code from es2gears has been moved to util in version 9.0.0 [1]
so now es2gears is linked with mesa3d-demo libutil (idep_util).
But at the same time the dependency on glu (dep_glu) has been added
to libutil [2]. dep_glu requires opengl (FULL_GL) to build.

In order to keep the es2gears for egl only builds we have to
split the libutil files list to build readtex.c and showbuffer.c
only if opengl is available.

Add back dep_glu since it's used in util's meson.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4936948236
https://gitlab.com/buildroot.org/buildroot/-/jobs/4936948042

[1] c33e2f731c
[2] ef24aae229

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Julien Olivain <ju.o@free.fr>
Reviewed-by: Julien Olivain <ju.o@free.fr>
Tested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 17:52:13 +02:00
Waldemar Brodkorb
855f78edd4 package/pam: fix uclibc compile error
Following build failure occurs:
opasswd.c: In function 'compare_password':
opasswd.c:142:3: error: 'retval' undeclared (first use in this function); did you mean 'outval'?
  142 |   retval = outval != NULL && strcmp(outval, oldpass) == 0;
      |   ^~~~~~
      |   outval

Add a patch from upstream to fix it.
Happens since the update to 1.5.3 in Buildroot commit:
f8147e27cd

Fixes:
 - http://autobuild.buildroot.net/results/576/576fc4b9ccbc6cff82569692bdec82192e89f036

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 17:50:47 +02:00
Bernd Kuhls
99674f64ba {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 4}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 14:45:17 +02:00
Julien Olivain
d44a888c32 support/testing: python-magic-wormhole: fix random failures
The magic-wormhole "receive" command can output "waiting" messages
when key receival or verification are longer than a predefined
timeout:
https://github.com/magic-wormhole/magic-wormhole/blob/0.13.0/src/wormhole/cli/cmd_receive.py#L135

The intent is to have an interactive user experience.

This behavior makes the runtime test unreliable as the test always
expect the sent message as the exact output. When the test execution
is slower, it sometimes get the "waiting" message instead of the
expected message.

Some test jobs are succeeding:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4968059737
while some other are failing.

magic-wormhole can override those timers with environment variables.
See:
https://github.com/magic-wormhole/magic-wormhole/blob/0.13.0/src/wormhole/cli/cmd_receive.py#L26

This commit sets those environment variable to larger values
(100 seconds instread of 1 by default), to make sure the test will
always pass.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4962923235

Reported-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Tested-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 09:43:55 +02:00
Romain Naour
aab82a29bc configs/beaglev_defconfig: fix build with binutils >= 2.38
Backport an upstream patch fixing the build with binutils >= 2.38
for riscv's for Zicsr and Zifencei.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4987456149

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 09:40:27 +02:00
Romain Naour
698562e7f5 configs/hifive_unleashed_defconfig: uboot needs OpenSSL
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4987456270

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 09:40:22 +02:00
Daniel Lang
7dd5233b55 package/libxcrypt: fix another build issue with perl >= 5.38
perl 5.38 deprecated smartmatch (~~ and the given/when syntax).
Backport another upstream patch to drop uses of given.

Fixes:
- http://autobuild.buildroot.net/results/727/727aa831881af36394bafef9e13a0dcbd9d0db3a

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 09:40:18 +02:00
Julien Olivain
bf7926230c package/libgpgme: always use gpgrt-config from buildroot staging
gpgme updated its gpg-error.m4 macro files to detect gpgrt-config at
several occasions. Those changes are included since buildroot commit
13f3b8e124 "package/libgpgme: bump to version 1.20.0".

gpgrt-config path needs to be forced in _CONF_ENV to make sure it
will work in all host environments. See the log entry of commit
d7f2d8403e "package/gnupg2: fix build failure when host provides an
old gpgrt-config" [2] for a complete explanation.

[1] https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git;a=history;f=m4/gpg-error.m4;h=gpgme-1.20.0
[2] https://git.buildroot.org/buildroot/commit/?id=d7f2d8403ec82f3b1772ec17bf1df8c42987a1f8

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 09:35:42 +02:00
Peter Korsgaard
fbcc1bf533 docs/website: Update for 2023.02.4
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-08-31 21:30:47 +02:00
Peter Korsgaard
d283473ae4 Update for 2023.02.4
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3b8e5b19ad)
[Peter: drop Makefile/Vagrantfile changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-08-31 21:28:50 +02:00
Peter Korsgaard
1f137a03ea docs/website: Update for 2023.05.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-08-31 20:28:40 +02:00
Peter Korsgaard
386b72ca22 Update for 2023.05.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3923a4fac8)
[Peter: drop Makefile change]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-08-31 20:12:26 +02:00
Bernd Kuhls
16c3b4b92b {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 4}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-08-30 23:45:22 +02:00
Fabrice Fontaine
3c8d890c19 toolchain/helpers.mk: strengthen uClibc locale check
Currently, when verifying the configuration of a uClibc toolchain for
the presence of locale support, we check __UCLIBC_HAS_LOCALE__. It
turns out that we in fact also expect __UCLIBC_HAS_XLOCALE__ to be
defined, as without it locale_t is not defined, causing build failure
in some packages, such as libcpprestsdk:

In file included from /home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/include/cpprest/json.h:18,
                 from /home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/src/pch/stdafx.h:88,
                 from /home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/src/http/client/http_client_msg.cpp:13:
/home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/include/cpprest/asyncrt_utils.h:317:13: error: 'locale_t' does not name a type
  317 |     typedef locale_t xplat_locale;
      |             ^~~~~~~~

As essentially our requirement for uClibc in external toolchains is
"it should match the uClibc configuration used by Buildroot for
internal toolchains", it makes sense to verify
__UCLIBC_HAS_XLOCALE__. Note that of course checking
__UCLIBC_HAS_XLOCALE__ is sufficient, as it cannot be enabled if
__UCLIBC_HAS_LOCALE isn't.

This addresses an issue with the Synopsys ARC external toolchain,
which is built with __UCLIBC_HAS_LOCALE__, but without
__UCLIBC_HAS_XLOCALE__ causing a build failure with some
packages (such as libcpprestsdk).

Therefore, this patch also changes how the Synospys ARC external
toolchain is exposed in Buildroot: it no longer advertise locale
support.

Fixes:

  http://autobuild.buildroot.org/results/e6778e60cc1ea455f5b4511d5824f04d8040f67b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-08-30 23:44:24 +02:00
Daniel Lang
6fa3a239ac support/scripts/gen-missing-cpe: remove rarely used script
The intention of this script is to generate the XML that can be sent to
NVD to request a new CPE identifier.

As discussed on the mailing list [0] keeping up with version numbers of
all registered CPE ID won't work.
In addition the feed used to generated the XML files will be retired
[1]. In the future an API needs to be used for fetching the data in
connection with a local database.
All of this works against keeping this script and porting it to the new
API.
As a last blow Matthew, the original author concluded [2]:
> Makes sense to drop it.  There never got to be enough momentum in the overall
> software community to make CVE or even the new identifier really accurate.

The intention is to ignore the version part of CPE IDs in the future,
and only look at the version range specified on a CVE. Therefore, a tool
to add new CPE ID versions isn't useful to us. It might still be useful
to have a tool to create the vendor and project parts of a CPE ID.
However, the current gen-missing-cpe tool doesn't support that, and the
API is anyway going to be retired. So there is no reason at all to keep
this around.

Remove gen-missing-cpe and the cpedb module. Remove the Makefile target
to call the script.

Since the cpedb module is removed, the CPEDB_URL definition must be
moved to the place where it is still used, in pkg-stats.

[0]: https://lists.buildroot.org/pipermail/buildroot/2023-August/672620.html
[1]: https://nvd.nist.gov/General/News/change-timeline
[2]: https://lists.buildroot.org/pipermail/buildroot/2023-August/672651.html

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 22:39:23 +02:00
Daniel Lang
8997c746fa support/scripts/pkg-stats: fix typos
Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 22:22:05 +02:00
Thomas Petazzoni
829610c701 package/heirloom-mailx: ignore CVE-2004-2771
The CVE-2004-2771 is already fixed by the Debian patch
0014-globname-Invoke-wordexp-with-WRDE_NOCMD.patch. The Debian patch
description is:

Subject: [PATCH 4/4] globname: Invoke wordexp with WRDE_NOCMD (CVE-2004-2771)

See also https://marc.info/?l=oss-security&m=141875285203183&w=2 for
more details.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 22:12:02 +02:00
Thomas Petazzoni
94716fdb48 package/heirloom-mailx: fix comment about ignore CVE-2014-7844
In commit
15972770cf ("package/heirloom-mailx:
security bump to version 12.5-5 from Debian"), we added CVE-2014-7844
in HEIRLOOM_MAILX_IGNORE_CVES, but with the wrong comment about it: it
is a different patch in the Debian stack of patches that fixes
it. Indeed the description of patch
0011-outof-Introduce-expandaddr-flag.patch is:

=====================================================================
Subject: [PATCH 1/4] outof: Introduce expandaddr flag

Document that address expansion is disabled unless the expandaddr
binary option is set.

This has been assigned CVE-2014-7844 for BSD mailx, but it is not
a vulnerability in Heirloom mailx because this feature was documented.
=====================================================================

See also https://marc.info/?l=oss-security&m=141875285203183&w=2 for
details.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 22:05:13 +02:00
Thomas Petazzoni
cf686670b9 package/log4cxx: ignore CVE-2023-31038
CVE-2023-31038 affects log4cxx only if ODBC is supported. While
CVE-2023-31038 has been fixed in newer versions of log4cxx, there is
quite a huge gap to do a version bump, and the commit that fixes
CVE-2023-31038 could not be identified.

Therefore, we want to rely on the fact that our log4cxx package does
not support ODBC: there is indeed no explicit dependency on our
unixodbc package in log4cxx.mk. However, log4cxx automatically detects
if ODBC is available and if it is, it uses it.

So what we do in this commit is backport an upstream commit, which
adds explicitly options to enable/disable ODBC and ESMTP support, and
we use them to (1) always disable ODBC and (2) explicitly
enable/disable ESMTP support.

Thanks to ODBC being disabled, we're not affected by CVE-2023-31038.

Of course, there is a potential regression for users who were relying
on the implicit unixodbc dependency, but as we could not identify the
commit fixing the CVE-2023-31038, this is the best we can do at the
moment.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 22:02:45 +02:00
Arnout Vandecappelle
6bee7c3eb2 .checkpackageignore: correct renamed path of openjdk 17.0.8+7 patch
Commit c1038fe47c renamed the patch, but didn't update
.checkpackageignore, leading to two failures:

.checkpackageignore:1055: ignored file package/openjdk/17.0.7+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch is missing
package/openjdk/17.0.8+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch:0: missing Upstream in the header (http://nightly.buildroot.org/#_additional_patch_documentation)

Rename the file in .checkpackageignore as well.

Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 21:57:01 +02:00
Thomas Petazzoni
65c99394ff boot/grub2: backport fixes for numerous CVEs
Grub 2.06 is affected by a number of CVEs, which have been fixed in
the master branch of Grub, but are not yet part of any release (there
is a 2.12-rc1 release, but nothing else between 2.06 and 2.12-rc1).

So this patch backports the relevant fixes for CVE-2022-28736,
CVE-2022-28735, CVE-2021-3695, CVE-2021-3696, CVE-2021-3697,
CVE-2022-28733, CVE-2022-28734, CVE-2022-2601 and CVE-2022-3775.

It should be noted that CVE-2021-3695, CVE-2021-3696, CVE-2021-3697
are not reported as affecting Grub by our CVE matching logic because
the NVD database uses an incorrect CPE ID in those CVEs: it uses
"grub" as the product instead of "grub2" like all other CVEs for
grub. This issue has been reported to the NVD maintainers.

This requires backporting a lot of patches, but jumping from 2.06 to
2.12-rc1 implies getting 592 commits, which is quite a lot.

All Grub test cases are working fine:

  https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500585
  https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500679

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Arnout: fix check-package warning in patch 0002]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 21:54:23 +02:00
Yann E. MORIN
60f50a5e34 package/pcm-tools: fix github-download
The pcm-tools package contains a version.h with git attributes:

    $ cat version.h
    #define PCM_VERSION " ($Format:%ci ID=%h$)"

    $ man 5 gitattributes
       Creating an archive
         export-subst
           If the attribute export-subst is set for a file then Git
           will expand several placeholders when adding this file to
           an archive. The expansion depends on the availability of
           a commit ID, i.e., if git-archive(1) has been given a tree
           instead of a commit or a tag then no replacement will be
           done. The placeholders are the same as those for the option
           --pretty=format: of git-log(1), except that they need to be
           wrapped like this: $Format:PLACEHOLDERS$ in the file. E.g.
           the string $Format:%H$ will be replaced by the commit hash.

So, the archive generated by github has changed since we updated
pcm-tools in 2021-12-08 with commit d1d93d488c (package/pcm-tools:
bump to version 202110). The downlad was still OK in 2022-01-04 [0]
but has been failing at least since 202-08-25 [1].

Since the archive is generated on the github side, there is not much we
can do to fix this up.

We switch over to using git to do the download, and we generate the
archive localy, which we know is reproducible.

We fix the version.h so that it contains the same string as the backup
tarball we host on s.b.o.

There are three other files in pcm-tools that have git attributes, to
exclude them from the generated archive, all pertaining to CI/CD stuff:
    .cirrus.yml export-ignore
    .gitlab-ci.yml export-ignore
    .travis.yml export-ignore

We don't remove them, because they have no impact on the build, and they
are anyway already present in the archive by the time we could act on it
anyway...

[0] http://autobuild.buildroot.org/results/127/1276a3d49c8848039f034e7f03632df365097e94/
[1] http://autobuild.buildroot.org/results/8bb/8bbf9c36af332bbf5e7c1abcbb594a0b231ef97e/

Reported-by: Woody Douglass <wdouglass@carnegierobotics.com>
Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 21:40:46 +02:00
Adam Duskett
c1038fe47c package/openjdk{-bin}: security bump versions to 11.0.20+8 and 17.0.8+7
Fixed the following security issues:

* CVEs
  - CVE-2023-22006
  - CVE-2023-22036
  - CVE-2023-22041
  - CVE-2023-22044
  - CVE-2023-22045
  - CVE-2023-22049
  - CVE-2023-25193
* Security fixes
  - JDK-8298676: Enhanced Look and Feel
  - JDK-8300285: Enhance TLS data handling
  - JDK-8300596: Enhance Jar Signature validation
  - JDK-8301998, JDK-8302084: Update HarfBuzz to 7.0.1
  - JDK-8302475: Enhance HTTP client file downloading
  - JDK-8302483: Enhance ZIP performance
  - JDK-8303376: Better launching of JDI
  - JDK-8304468: Better array usages
  - JDK-8305312: Enhanced path handling
  - JDK-8308682: Enhance AES performance

For details, see the announcements:
https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-July/024064.html
https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-July/024063.html

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-08-30 21:36:43 +02:00
Daniel Lang
47b79476fb package/libxcrypt: fix build with perl >= 5.38
perl 5.38 deprecated smartmatch (~~ and the given/when syntax).
Backport an upstream patch to drop uses of when.

Fixes:
- http://autobuild.buildroot.net/results/04c/04cf8d79fe8a58c3438e7be95ae781c9b2bef8a0/

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-08-29 23:27:58 +02:00
Peter Korsgaard
04bc804630 Update for 2023.08-rc3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-08-29 15:00:27 +02:00
Waldemar Brodkorb
41280018b3 package/f2fs-tools: fix musl compile error
musl 1.2.4 removed the lseek64 function, but kept a definition of lseek64
when _LARGEFILE64_SOURCE is defined.

Add patch from upstream to kill the usage of lseek64.

There is no need to backport it to older Buildroot releases, because musl 1.2.4
is not part of any release.

Fixes:
 - http://autobuild.buildroot.net/results/17f/17f4ea7d62581cf8c574deeb98e1785220d5bd3f

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-08-29 12:42:03 +02:00