Commit Graph

57058 Commits

Author SHA1 Message Date
Bernd Kuhls
90906fee02 package/fetchmail: bump version to 6.4.21
Release notes:
https://sourceforge.net/p/fetchmail/mailman/message/37333073/

"It contains the security fix for CVE-2021-36386 of 6.4.20, and fixes
a regression/a bug that causes log message truncation/run-together
prominently visible with --logfile that was introduced into 6.4.20."

Updated note for CVE-2021-36386:
https://sourceforge.net/p/fetchmail/mailman/message/37333078/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b8a1d969b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 22:49:31 +02:00
Peter Korsgaard
9c1b9ec84b package/php: security bump version to 7.4.23
Quoting https://www.php.net/
"This is a security fix release."

Changelog: https://www.php.net/ChangeLog-7.php#7.4.23

CVE-ID were not mentioned in any of the fixed bugs.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 22:37:07 +02:00
Bernd Kuhls
4fb7a73698 package/samba4: bump version to 4.14.7
Release notes of this bugfix release:
https://www.samba.org/samba/history/samba-4.14.7.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 630e85f8f5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 22:22:49 +02:00
Fabrice Fontaine
3aeaf14543 package/c-ares: add C_ARES_CPE_ID_VENDOR
cpe:2.3🅰️c-ares_project:c-ares is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ac-ares_project%3Ac-ares

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2990d7dcb1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 15:54:34 +02:00
Fabrice Fontaine
98fb8a6786 package/c-ares: fix build with latest nodejs
Fix the following build failure with nodejs raised since bump to version
12.22.5 in commit 7038b029d8:

../src/cares_wrap.cc:42:11: fatal error: ares_nameser.h: No such file or directory
   42 | # include <ares_nameser.h>
      |           ^~~~~~~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/a0f867d5e765fc1aa052de5e53ed350b3b20743f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a9ca15cf92)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 15:53:41 +02:00
Fabrice Fontaine
1d18c730bb package/c-ares: security bump to version 1.17.2
- NodeJS passes NULL for addr and 0 for addrlen to
  ares_parse_ptr_reply() on systems where malloc(0) returns NULL. This
  would cause a crash.
- If ares_getaddrinfo() was terminated by an ares_destroy(), it would
  cause a crash
- Crash in sortaddrinfo() if the list size equals 0 due to an unexpected
  DNS response
- Expand number of escaped characters in DNS replies as per RFC1035 5.1
  to prevent spoofing follow-up
- Perform validation on hostnames to prevent possible XSS due to
  applications not performing valiation themselves

https://c-ares.haxx.se/changelog.html#1_17_2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6be5219c41)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 15:53:32 +02:00
Yann E. MORIN
d67ef48882 docs/manual: fix typo in name of a qmake-package variable
Since commit 39d334faa5 (package/pkg-qmake: add <pkg>_SYNC_QT_HEADERS
support), the qmake-package infra recognises said variable but the
manual has the wrong variable name, which is missing the "_QT" part.

We fix that by amending the manual to document the proper variable name.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ac2db5eb2e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 15:52:25 +02:00
Fabrice Fontaine
2c9db9b2dd package/xen: fix build with 64 bits time_t
Fix build of xen with 64 bits time_t:

/tmp/instance-0/output-1/build/xen-4.14.2/tools/qemu-xen/hw/input/virtio-input-host.c: In function 'virtio_input_host_handle_status':
/tmp/instance-0/output-1/build/xen-4.14.2/tools/qemu-xen/hw/input/virtio-input-host.c:198:28: error: 'struct input_event' has no member named 'time'
  198 |     if (gettimeofday(&evdev.time, NULL)) {
      |                            ^

Fixes:
 - http://autobuild.buildroot.org/results/136ce42f44bf48d3db4eda7b1548bf7ac1b97d51

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7ba9967287)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 15:25:38 +02:00
Romain Naour
83b14eb433 support/testing: test_atf: bump the custom version to v2.5
This version bump is needed to pass the ATF test with
hardening option enabled (-fstack-protector-strong)

With the version v2.2, ATF fail due to undefined references:

./build/juno/release/bl2u/arm_tzc400.o: In function `arm_tzc400_setup':
arm_tzc400.c:(.text.arm_tzc400_setup+0x10): undefined reference to `__stack_chk_guard'
arm_tzc400.c:(.text.arm_tzc400_setup+0x18): undefined reference to `__stack_chk_guard'
arm_tzc400.c:(.text.arm_tzc400_setup+0xb8): undefined reference to `__stack_chk_guard'
arm_tzc400.c:(.text.arm_tzc400_setup+0xcc): undefined reference to `__stack_chk_fail'

Since commit ccac9a5bbb, Buildroot no
longer forces ENABLE_STACK_PROTECTOR. However, we rely on the ATF build
system to handle it correctly, and this wasn't the case in v2.2.

Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/1524842591

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e5494f1fac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 14:59:09 +02:00
Conrad Ratschan
4a60661280 package/coreutils: Prevent overwriting of fakedate
When BR2_REPRODUCIBLE is set and host-coreutils needs to be built, the
fakedate script installed to 'host/bin/date' will be overwritten by
host-coreutils.

Besides, we do not need our host-coreutils for 'date' at all; we really
rely on the host system to provide it.

Unconditionally disable installing the 'date' binary in host-coreutils.

Note that we explicitly request only ln and realpath to be installed,
but the coreutils buildsystem does not strictly obey to that, as was
already noticed in 885e6fdb8a (package/coreutils: introduce a host
variant), which added that comment above HOST_COREUTILS_CONF_OPTS:

    # Explicitly install ln and realpath, which we *are* insterested in.
    # A lot of other programs still get installed, however, but disabling
    # them does not gain much at build time, and is a loooong list that is
    # difficult to maintain...

So, we also update that comment to explain why we still anyway disable
installation of 'date'.

Signed-off-by: Conrad Ratschan <conrad.ratschan@collins.com>
[yann.morin.1998@free.fr:
  - unconditionally disable installing date
  - extend comment and commit log to explain why we need
    --enable-no-install-program=date despite the existing
    --enable-install-program=ln,realpath
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bdf7929109)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 14:39:39 +02:00
Fabrice Fontaine
4c787fb093 package/ipmiutil: avoid the need for autoreconf
Build fails since bump to version 3.1.7 in commit
011f31ee24 because config.h.in is older
than aclocal.m4:

make[1]: Entering directory '/tmp/instance-4/output-1/build/ipmiutil-3.1.7'
(CDPATH="${ZSH_VERSION+.}:" && cd . && autoheader)
/bin/bash: autoheader: command not found

Fixes:
 - http://autobuild.buildroot.org/results/2005af881726473f2cda176e90c1e41e4baea67c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5f9d65fb46)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 14:30:26 +02:00
Fabrice Fontaine
c9fcb51d13 package/nodejs: security bump to version 12.22.5
Fix CVE-2021-22931, CVE-2021-22940 and CVE-2021-22939:
https://nodejs.org/en/blog/vulnerability/aug-2021-security-releases

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7038b029d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 14:23:15 +02:00
Fabrice Fontaine
8b266388ee package/cjson: bump to version 1.7.15
Fixes:
- Fix potential core dumped for strrchr
- Fix null pointer crash in cJSON_CreateXxArray
- Fix several null pointer problems on allocation failure
- Fix a possible dereference of null pointer

https://github.com/DaveGamble/cJSON/releases/tag/v1.7.15

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit edcf8b6d5f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 12:11:26 +02:00
Peter Seiderer
086bb927c7 package/cjson: bump version to 1.7.14
Changelog ([1]):

  1.7.14 (Sep 3, 2020)
  Fixes:
    optimize the way to find tail node, see #503
    Fix WError error on macosx because NAN is a float. Thanks @sappo, see #484
    Fix some bugs in detach and replace. Thanks @miaoerduo, see #456

[1] https://github.com/DaveGamble/cJSON/blob/master/CHANGELOG.md

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8b16476e80)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 12:11:21 +02:00
Romain Naour
69ce56a989 configs/pc_x86_64_{efi, bios}_defconfig: update kernel to 4.19.204
gcc 10.x is now used by default but the kernel 4.18.10 used by
pc_x86_64_{efi,bios}_defconfig doesn't build with it.

Bump the kernel to 4.19.204 release that contains a lot of
fixes for newer gcc.

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/1525741062
https://gitlab.com/kubu93/buildroot/-/jobs/1525741060

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 206c098f78)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 12:08:11 +02:00
Gleb Mazovetskiy
0635b82339 package/alsa-utils: Fix alsa-plugins compatibility
Previously, alsa-plugins would not work if alsa-utils was installed
after it. This happened because:

1. alsa-plugins copies some files $(TARGET_DIR)/usr/share/alsa/alsa.conf.d
2. alsa-utils removes these files during installation ( rm -rf $(TARGET_DIR)/usr/share/alsa/;)

The `rm -rf` command was originally added as part of the fix for
https://bugs.buildroot.org/show_bug.cgi?id=1573 11 years ago.

The intention might have been to allow for unconfiguring some options
and then rebuilding alsa-utils. However, this is a scenario that does
not work anyway.

The simplest fix for the `alsa-plugins` compatibility issue appears to
be to remove the `rm -rf` command.

Signed-off-by: Gleb Mazovetskiy <glex.spb@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3454bc9924)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 12:07:08 +02:00
Michael Fischer
79033d8037 package/libopenssl: security bump version to 1.1.1l
Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 5eace9d35c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 08:58:59 +02:00
Thomas Petazzoni
f9d63a74df DEVELOPERS: drop Maxime Hadjinlian
Maxime has not been contributing to Buildroot for several years, so it
doesn't make sense to keep him in the DEVELOPERS file and make us
think that those packages are being maintained and to Cc: him on
patches affecting those packages.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a29124febf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 08:57:06 +02:00
Fabrice Fontaine
3631e0084e package/libarchive: security bump to version 3.5.2
Fix CVE-2021-36976: libarchive 3.4.1 through 3.5.1 has a use-after-free
in copy_string (called from do_uncompress_block and process_block).

https://github.com/libarchive/libarchive/releases/tag/v3.5.2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a223dd4aef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 08:37:36 +02:00
Fabrice Fontaine
3f3ed8b6fe package/belle-sip: add BELLE_SIP_CPE_ID_VENDOR
cpe:2.3🅰️linphone:belle-sip is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alinphone%3Abelle-sip

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a4a4330b73)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 08:36:59 +02:00
Peter Korsgaard
f86351591d package/localedef: bump to version 2.32-50-g737efa27 to match glibc
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-07 08:06:24 +02:00
Romain Naour
2abb3befe7 support/testing: test_docker_compose: bump the kernel to 4.19.204
gcc 10.x is now used by default but the kernel 4.19 used by
test_docker_compose doesn't build with it.

Bump the kernel to 4.19.204 release that contains a lot of
fixes for newer gcc.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5d60e07e27)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 21:09:21 +02:00
Giulio Benetti
ff4ff190a7 toolchain: improve conditions for gcc bug 99140
Gcc bug 99140 has been fixed on gcc 8.x but reappeared on gcc 9.x while
it's been fixed on gcc 10.x+. So let's update
BR2_TOOLCHAIN_HAS_GCC_BUG_99140 accordingly.

Fixes:
http://autobuild.buildroot.net/results/c55/c55f50a8d657695f0d5492c32efa666254cd7f99/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fe4e06d317)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 21:06:37 +02:00
Giulio Benetti
0eac66e0e9 package/libmodsecurity: disable -fPIC on m68k_cf
This package has -fPIC gcc option set by default but we can't use it on
m68k_cf since it doesn't support it throwing a gcc build failure. So let's
disable it by passing -fno-PIC.

Fixes:
http://autobuild.buildroot.net/results/b92980a563fe7ee331e70f288ce041be0bf29d40/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 2a48a6ee9d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 20:08:32 +02:00
Fabrice Fontaine
e5a984958d package/mesa3d: fix build on riscv32
Fix the following build failure on riscv32:

../src/util/futex.h: In function 'sys_futex':
../src/util/futex.h:39:19: error: 'SYS_futex' undeclared (first use in this function); did you mean 'sys_futex'?
   39 |    return syscall(SYS_futex, addr1, op, val1, timeout, addr2, val3);
      |                   ^~~~~~~~~
      |                   sys_futex

Fixes:
 - http://autobuild.buildroot.org/results/692700a5f967760a0b8cd358b1712f1d5a7b681e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3298e67ac6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 18:18:05 +02:00
Fabrice Fontaine
4c622b7791 package/sdl2: fix build with kmsdrm
Build with kmsdrm is broken since bump to version 2.0.14 in commit
5e0da5c40d. Indeed, first patch was
already applied in this version:
9354aea198
but upstream made other changes that requires EGL so add an upstream
patch to fix the build failure

Moreover, run autogen.sh instead of autoreconf as it breaks the build
and is not recommended by upstream:
https://github.com/libsdl-org/SDL/pull/4214

Fixes:
 - http://autobuild.buildroot.org/results/355c7e5092e7641d8b04ecb550e2671d70720bd2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Arnout: add dependency on host-autoconf]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9aae755440)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 17:41:04 +02:00
Fabrice Fontaine
32ffddf0bb package/sdl2: kmsdrm needs GBM
kmsdrm needs GBM (and so mesa3d) since its addition in version 2.0.6:
56363ebf61

If libgbm is not found, kmsdrm will be silently disabled

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 5bb4e281c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 17:39:44 +02:00
Romain Naour
e310dccbee Config.in: disable Fortify Source for microblaze
As reported by Toolchain-builder project [1], the microblaze glibc
toolchain creates a system that doesn't boot when FORTIFY_SOURCE is
enabled: the init process hangs.

Also, hardening features may not be wanted or possible for such
slow soft-core cpus [2].

Note: for completeness, BR2_RELRO_PARTIAL was manually tested and it
does boot.

[1] https://gitlab.com/bootlin/toolchains-builder/-/jobs/1467624500
[2] http://lists.busybox.net/pipermail/buildroot/2021-June/312416.html

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 2e94aeed1a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 17:36:05 +02:00
Matthew Weber
d657acfffb package/kvm-unit-tests: fix powerpc64 PHDR seg err
Upstream comment: "Let's introduce some fake PHDRs
to the linker script to get this working again."

Fixes:
(next) http://autobuild.buildroot.net/results/ae091dbcb155e63c208ce5adb289807cee83e28d/
(master) http://autobuild.buildroot.net/results/ef0/ef0b044802c54a697d8bffb28eba08cf9ce44f4c/
(2021.02.x) http://autobuild.buildroot.net/results/044/04495aa23ce51c48b9b850890453abded85dc477/
(2021.05.x) http://autobuild.buildroot.net/results/0fa/0fa94f1f930aa16cec3bc96e64bc57b460238a0a/

[Cherry-picked upstream]
5126732d73aa75a0bc84f898042bfe35640624b8

Signed-off-by: Matthew Weber <matthew.weber@collins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5cfaf5e23e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 17:09:53 +02:00
Fabrice Fontaine
a56e34c64a package/cpio: fix CVE-2021-38185
GNU cpio through 2.13 allows attackers to execute arbitrary code via a
crafted pattern file, because of a dstring.c ds_fgetstr integer overflow
that triggers an out-of-bounds heap write. NOTE: it is unclear whether
there are common cases where the pattern file, associated with the -E
option, is untrusted data.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 89857df2d1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 17:06:46 +02:00
Angelo Compagnucci
09164c0b4a linux: bump CIP RT kernel to version 4.19.198-cip54-rt21
This patch bumps Linux CIP RT to version 4.19.198-cip54-rt21

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 835ea5b94c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 16:47:05 +02:00
Angelo Compagnucci
72c3599b0c linux: bump CIP kernel to version 4.19.198-cip54
This patch bumps Linux CIP to version 4.19.198-cip54.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 595209da93)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 16:45:57 +02:00
Michael Fischer
2d7b00d4b6 package/gdb: bump version 10.x to 10.2
Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2ee1063136)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 15:43:21 +02:00
Fabrice Fontaine
5f651a510f Revert "package/libshout: enable optional dependency for libressl"
This reverts commit 46b8fb7500 indeed if
libressl is selected as the openssl provider, the BR2_PACKAGE_OPENSSL
conditition will always be used and the BR2_PACKAGE_LIBRESSL condition
will never be triggered. Moreover, libressl provides a pkg-config file.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit da4d8fc407)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 15:39:15 +02:00
Peter Korsgaard
d64b9a944c package/haproxy: security bump to version 2.2.16
Fixes the following security issues:

- CVE-2021-39240: An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3
  before 2.3.13, and 2.4 before 2.4.3.  It does not ensure that the scheme
  and path portions of a URI have the expected characters.  For example, the
  authority field (as observed on a target HTTP/2 server) might differ from
  what the routing rules were intended to achieve.

- CVE-2021-39241: An issue was discovered in HAProxy 2.0 before 2.0.24, 2.2
  before 2.2.16, 2.3 before 2.3.13, and 2.4 before 2.4.3.  An HTTP method
  name may contain a space followed by the name of a protected resource.  It
  is possible that a server would interpret this as a request for that
  protected resource, such as in the "GET /admin?  HTTP/1.1 /static/images
  HTTP/1.1" example.

- CVE-2021-39242: An issue was discovered in HAProxy 2.2 before 2.2.16, 2.3
  before 2.3.13, and 2.4 before 2.4.3.  It can lead to a situation with an
  attacker-controlled HTTP Host header, because a mismatch between Host and
  authority is mishandled.

For more details, see the advisory:
https://www.mail-archive.com/haproxy@formilux.org/msg41041.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 15:35:35 +02:00
Giulio Benetti
65a07bd610 package/openvmtools: fix time_t build failure on 32-bit platforms
Add upstream pending patch[1] to fix time_t on 32-bit platform.

[1]: https://github.com/vmware/open-vm-tools/pull/387

Fixes:
http://autobuild.buildroot.net/results/eb3dfe679536b578a0f16762312a96ada7162095/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 75b02d6f3d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 15:23:17 +02:00
Giulio Benetti
a6feaccf18 DEVELOPERS: add myself to toolchain topics/packages
Since I've dealt and deal with toolchain bugs and their work-around
very often add myself to toolchain topic(toolchain/) as well as
package/binutils and package/gcc.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8d0fcab128)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 14:27:12 +02:00
Matthew Weber
1d5b786911 package/eigen: override Fortran path
The language detection is falling back to the host system
Fortran compiler. An example of this is in RHEL7.9
(gcc4.8.5 20150623 (Red Hat 4.8.5-44)).

This patch bypasses detection and points to the location
where the compiler would be installed (if present). In the
cases where it doesn't exist, the detection falls through
and leaves Fortran disabled.

Fixes:
http://autobuild.buildroot.net/results/8354da225d1e5e337aa7ea62a7e6524fb5f1135f/

Signed-off-by: Matthew Weber <matthew.weber@collins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9f59154245)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 14:25:52 +02:00
Bernd Kuhls
d35b87a605 package/postgresql: security bump version to 13.4
Release notes:
https://www.postgresql.org/about/news/postgresql-134-128-1113-1018-9623-and-14-beta-3-released-2277/

Fixes CVE-2021-3677:
https://www.postgresql.org/support/security/CVE-2021-3677/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 743f3a4c54)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-06 12:37:50 +02:00
Peter Korsgaard
05585d38d3 package/tor: security bump to version 0.4.5.10
Fixes CVE-2021-38385: https://blog.torproject.org/node/2062

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-05 22:02:54 +02:00
Asaf Kahlon
e1fedf442e package/python-secretstorage: depend comment on BR2_PACKAGE_PYTHON3
The user shouldn't see the comment on the python2 menu.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bf0b9048f2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 23:47:23 +02:00
Asaf Kahlon
12545dd5bd package/python-keyring: depend comment on BR2_PACKAGE_PYTHON3
The user shouldn't view the comment on the python2 menu.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6a932714d3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 23:40:22 +02:00
Fabrice Fontaine
6cdae45fd3 package/fontconfig: fix build with NLS
Add TARGET_NLS_DEPENDENCIES and host-gettext dependency to avoid the
following build failure in a per-package-directorie build with
host-cairo raised because fontconfig installs its ITS files in the wrong
directory (i.e. outside of gettext-tiny symlink):

mkdir -p /tmp/instance-0/output-1/per-package/host-cairo/host
rsync -a --link-dest=/tmp/instance-0/output-1/per-package/host-fontconfig/host/ /tmp/instance-0/output-1/per-package/host-fontconfig/host/ /tmp/instance-0/output-1/per-package/host-cairo/host
rsync -a --link-dest=/tmp/instance-0/output-1/per-package/host-freetype/host/ /tmp/instance-0/output-1/per-package/host-freetype/host/ /tmp/instance-0/output-1/per-package/host-cairo/host
rsync -a --link-dest=/tmp/instance-0/output-1/per-package/host-libglib2/host/ /tmp/instance-0/output-1/per-package/host-libglib2/host/ /tmp/instance-0/output-1/per-package/host-cairo/host
cannot delete non-empty directory: share/gettext
could not make way for new symlink: share/gettext

This only happens with per-package directories because then the rsync is
done. Otherwise the fontconfig installation will simply follow the
symlink.

The error of course exists for target as well, but doesn't occur in
autobuilders since it already fails for host.

Fixes:
 - http://autobuild.buildroot.org/results/00e29958cecfffa4e994ab549637117dd8f55c30

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 93351fa0b3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 23:36:19 +02:00
Fabrice Fontaine
ed54e66af6 package/fontconfig: break circular dependency
Build fails because of the following circular dependency:

fontconfig -> util-linux -> udev -> systemd -> polkit ->
gobject-introspection -> cairo -> fontconfig

which results in the following build failure:

checking for UUID... no
checking where uuid functions comes from... configure: error:
*** uuid is required. install util-linux.

To break it, apply the same ugly workaround that was applied for
libglib2 and cryptsetup until a better solution is found:
https://patchwork.ozlabs.org/project/buildroot/patch/20201101150619.1709959-1-fontaine.fabrice@gmail.com/

Fixes:
 - http://autobuild.buildroot.org/results/2c6ef073e7e98e13daa409e1ea6130e9abd32c87

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit eb05822259)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 23:36:12 +02:00
Peter Korsgaard
6bb11a7721 package/busybox/udhcpc.script: ensure action argument is correctly passed to hook scripts
commit f79a420825 (package/busybox/udhcpc.script: support RFC3442
static routes) used 'set --' clobbering the positional arguments, causing
the action argument to not be correctly forwarded to hook scripts for the
renew / bound cases if static routes are provided by the server.

As a workaround, save the action argument at the beginning of the script and
use that when calling hook scripts.

Reported-by: 王琦 <wangwangqi2011@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 94c41eef61)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 23:02:35 +02:00
Fabrice Fontaine
14e07eb7b2 package/libargtable2: update LIBARGTABLE2_VERSION
Update LIBARGTABLE2_VERSION to reflect what is used by
https://release-monitoring.org

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5a3d1f34bc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 22:59:04 +02:00
Fabrice Fontaine
0b45059785 package/iozone: update IOZONE_VERSION
Update IOZONE_VERSION to reflect what is used by
https://release-monitoring.org

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1e75050bbb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 22:58:05 +02:00
Fabrice Fontaine
c64565e980 package/sqlite: add SQLITE_TAR_VERSION
3.34.1 is the version used by https://release-monitoring.org as well as
NVD NIST database so add SQLITE_TAR_VERSION and drop
SQLITE_CPE_ID_VERSION

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3943b6f003)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 22:57:08 +02:00
Kyle Harding
7e3b63f6b6 package/unbound: bump to version 1.13.2
The release contains a bugfix to fix the make install of the python
module after build changes introduced in this release RC1.

This release contains a number of bug fixes. There is a crash fix for
broken internal structures in stream reuse, that is used when many TCP
or TLS upstream connections are made. Also a number of features are added.

https://github.com/NLnetLabs/unbound/releases/tag/release-1.13.2

Signed-off-by: Kyle Harding <kyle@balena.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aaad2ab8e3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 22:52:04 +02:00
Thomas Petazzoni
8c6f578a4b DEVELOPERS: drop Sven Fischer
Sven has privately asked to no longer receive notifications related to
this package.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 829ecf7d79)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-09-04 22:48:05 +02:00