Commit Graph

57114 Commits

Author SHA1 Message Date
Edgar Bonet
56bc92c3ba support/testing/infra/emulator.py: prevent the commands from wrapping
Traditional VT-10x terminals (and their emulators) [0] have a "magic
margins" feature that enables the last character position to be updated
without scrolling the screen: whenever a character is printed on the
last column, the cursor stays over the character, instead of moving to
the next line.

The Busybox shell, ash, attempts to defeat this feature by printing
CR,LF right after echoing a character to the last column.[1] This
doesn't play well with emulator.py. The run() method of the Emulator
class captures the output of the emulated system and assumes the first
line it reads is the echo of the command, and all subsequent lines are
the command's output. If the line made by the command + shell prompt is
longer than 80 characters, then it is echoed as two or more lines, and
all but the first one are mistaken for the command's output.

We fix this by telling the emulated system that we are using an
ultra-wide terminal with 29999 columns. Larger values would be ignored
and replaced by the default, namely 80 columns.[2]

[0] https://vt100.net/docs/vt100-ug/chapter3.html  -  DECAWM
[1] https://git.busybox.net/busybox/tree/libbb/lineedit.c?h=1_34_0#n412
[2] https://git.busybox.net/busybox/tree/libbb/xfuncs.c?h=1_34_0#n258

Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Co-authored-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eb3ee3078a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-09 13:28:39 +02:00
Christian Stewart via buildroot
113707c7c5 package/go: security bump to version 1.16.9
go1.16.9 (released 2021-10-07) includes a security fix to the linker and
misc/wasm directory, as well as bug fixes to the runtime and to the
text/template package.

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-09 11:16:36 +02:00
Fabrice Fontaine
0b13ddf5ca package/nmap: add zlib optional dependency
zlib is an optional dependency since bump to version 7.60 in commit
c4faf1d4d1 and
0c142333bb.
If it is not disabled, nmap will build its own zlib version which can
result in the following build failure:

/home/giuliobenetti/autobuild/run/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/i686-buildroot-linux-uclibc/9.3.0/../../../../i686-buildroot-linux-uclibc/bin/ld: attempted static link of dynamic object `libz.so.1.2.11'

Fixes:
 - http://autobuild.buildroot.org/results/da9469e24390c94fe74f133152dc320c21872159
 - http://autobuild.buildroot.org/results/53034d8dd506bc033dc92343f9a37cd4ac8b2142

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e991c2cba6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-07 09:45:57 +02:00
Giulio Benetti
99557307ae DEVELOPERS: add Giulio Benetti to python-uvloop package
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 54866ac074)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-07 09:38:42 +02:00
Edgar Bonet
b427b8e288 support/kconfig: fix compiler warnings
Compiling on Ubuntu 20.04 generates this:

./util.c: In function ‘file_write_dep’
./util.c:54:18: warning: ‘..config.tmp’ directive writing 12 bytes into a region of size between 1 and 4097 [-Wformat-overflow=]
   54 |  sprintf(buf, "%s..config.tmp", dir);
      |                  ^~~~~~~~~~~~
./util.c:54:2: note: ‘sprintf’ output between 13 and 4109 bytes into a destination of size 4097
   54 |  sprintf(buf, "%s..config.tmp", dir);
      |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

and similar warnings on confdata.c, lines 778, 989, 995, 1000, 1007,
1040, 1046 and 1054. Avoid the warnings by enlarging the destination
buffer of fprintf().

Normally, we want changes to kconfig to be reflected by patches in
support/kconfig/patches. This makes it easier to resync with upstream
kconfig. However, in this case, everything that is changed here is
already changed completely (and differently) upstream, so there is no
added value in keeping the patch.

Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 324612d68e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-07 08:22:15 +02:00
Francois Perrad
e333589d34 package/openldap: bump to version 2.4.59
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 6097cd235e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 17:45:04 +02:00
Giulio Benetti
b9171471c3 package/dc3dd: disable on arc
Disable dc3dd on arc like we've done for riscv32 because of the size of
time_t:

In file included from getdate.y:40:
verify.h:132:30: error: negative width in bit-field 'verify_error_if_negative_size__'
  132 |       (struct { unsigned int verify_error_if_negative_size__: (R) ? 1 : -1; }))
      |                              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
verify.h:138:61: note: in expansion of macro 'verify_true'
  138 | # define verify(R) extern int (* verify_function__ (void)) [verify_true (R)]
      |                                                             ^~~~~~~~~~~
getdate.y:116:1: note: in expansion of macro 'verify'
  116 | verify (LONG_MIN <= TYPE_MINIMUM (time_t) && TYPE_MAXIMUM (time_t) <= LONG_MAX);
      | ^~~~~~

Fixes:
http://autobuild.buildroot.net/results/9e2/9e2a8f0548ecb5ce9539eda007cd886ddea7dc0a/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit fa937f2756)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 17:43:08 +02:00
Francois Perrad
ee1f32cb8f package/dash: bump to version 0.5.11.5
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 71e99d573c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 17:41:36 +02:00
Fabrice Fontaine
1f56d6fc73 package/atftp: security bump to version 0.7.5
- Fix CVE-2021-41054: tftpd_file.c in atftp through 0.7.4 has a buffer
  overflow because buffer-size handling does not properly consider the
  combination of data, OACK, and other options.
- Update hash of license file (license replaced with current version of
  the GPL text:
  bf22ccaef3)

https://sourceforge.net/p/atftp/code/ci/v0.7.5/tree/Changelog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit f39ae602ac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 17:28:01 +02:00
Sam Voss
03952dfb73 package/ripgrep: ignore CVE-2021-3013 as Windows only
CVE-2021-3013 does not impact any buildroot versions of ripgrep as it is
a Windows-only exploit targeting ripgrep versions earlier than 13. It
can be safely ignored on our LTS branches.

    https://nvd.nist.gov/vuln/detail/CVE-2021-3013

Signed-off-by: Sam Voss <sam.voss@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 641beb3217)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 17:19:22 +02:00
Kory Maincent
b22acc487f support/testing: don't fail on tests emitting invalid utf-8 sequences
When booting under EFI, grub2 will output a nice and shiny boot menu,
using extended ASCII characters (in the [0x80..0xFF] range), namely
CP437 [0], on the assumption that the VGA BIOS is a real one and has the
corresponding (and only!) font, as is the case on real hardware.

However, when run in our runtime test infrastructure, this triggers the
infamous python UnicodeDecodeError exception:

    Traceback (most recent call last):
      [...]
        emulator.login()
      File "[...]/buildroot/support/testing/infra/emulator.py", line 89, in login
        index = self.qemu.expect(["buildroot login:", pexpect.TIMEOUT],
      File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 340, in expect
        return self.expect_list(compiled_pattern_list,
      File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 369, in expect_list
        return exp.expect_loop(timeout)
      File "/usr/lib/python3/dist-packages/pexpect/expect.py", line 111, in expect_loop
        incoming = spawn.read_nonblocking(spawn.maxread, timeout)
      File "/usr/lib/python3/dist-packages/pexpect/pty_spawn.py", line 485, in read_nonblocking
        return super(spawn, self).read_nonblocking(size)
      File "/usr/lib/python3/dist-packages/pexpect/spawnbase.py", line 178, in read_nonblocking
        s = self._decoder.decode(s, final=False)
      File "/usr/lib/python3.8/codecs.py", line 322, in decode
        (result, consumed) = self._buffer_decode(data, self.errors, final)
    UnicodeDecodeError: 'utf-8' codec can't decode byte 0xda in position 0: invalid continuation byte

Grub2 is not wrong in emitting those chars, and basically we should not
expect the packages we test to always emit correct UTF-8 sequences; at
the very least, this should not cause the test infra to fail.

We fix that by telling pexpect.spawn to "fix" such invalid sequences by
replacing them with the suitable Unicode character, U+FFFD REPLACEMENT
CHARACTER.

[0] https://en.wikipedia.org/wiki/Code_page_437
[1] https://docs.python.org/3/library/codecs.html#error-handlers

Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[yann.morin.1998@free.fr:
  - don't change encoding, use codec_errors
  - rewrite commit log accordingly
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d6d7cbb8e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 16:56:43 +02:00
Asaf Kahlon
3b4681098b package/python-urllib3: bump to version 1.26.7
Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit dc0583bd34)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 16:53:02 +02:00
Christian Stewart via buildroot
f042920362 package/runc: fix typo of toolchain in config.in
BR2_TOOLCHAN_USES_UCLIBC -> BR2_TOOLCHAIN_USES_UCLIBC

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b03ea972ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 16:37:37 +02:00
Christian Stewart via buildroot
2593b03c03 package/lxc: fix typo of toolchain in config.in
BR2_TOOLCHAN_USES_UCLIBC -> BR2_TOOLCHAIN_USES_UCLIBC

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 71ce29eff3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 16:37:36 +02:00
Antoine Tenart
bba5c4345a package/refpolicy: make sure xmllint is used
When parsing and adding modules the refpolicy build system checks their
validity using xmllint. By default the host system version is used and
if not found an error is displayed but the build is not stopped. This
leads to interesting issues where modules are not added correctly to
modules.conf[1] (other possible issues are likely).

Fix this by adding a dependency on host-libxml2 and explicitly use the
xmllint binary built by Buildroot.

[1] https://lore.kernel.org/buildroot/20210830114531.2285178-1-jose.pekkarinen@unikie.com/

Tested-by: José Pekkarinen <jose.pekkarinen@unikie.com>
Signed-off-by: Antoine Tenart <atenart@kernel.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5141cee109)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 16:31:55 +02:00
Asaf Kahlon
7da52aaf0f package/python-texttable: bump to version 1.6.4
Plus, indent with two spaces in the hash file.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
(cherry picked from commit 1c543c729e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 16:30:36 +02:00
Fabrice Fontaine
43088ce478 package/mtr: use ncurses option
Use --with-ncurses and --without-ncurses options which are available
since version 0.88 and
4e2a948a16

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit edb65b4e6d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 16:19:33 +02:00
Christian Stewart via buildroot
acd584eb90 package/docker-cli: bump version to 20.10.8
For release notes:

https://github.com/moby/moby/releases/tag/v20.10.8

Signed-off-by: Christian Stewart <christian@paral.in>
(cherry picked from commit 041e4b1cea)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 15:29:57 +02:00
Christian Stewart via buildroot
6204d45234 package/docker-engine: bump to version 20.10.8
Signed-off-by: Christian Stewart <christian@paral.in>
(cherry picked from commit fc7646565b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 15:29:55 +02:00
Peter Korsgaard
91b18fe5e8 package/python-django: bump to version 3.2.7
Bugfix release, fixing a number of regressions:

- Fixed a regression in Django 3.2 that caused a crash validating "NaN"
  input with a forms.DecimalField when additional constraints, e.g.
  max_value, were specified (#32949).

- Fixed a bug in Django 3.2 where a system check would crash on a model with
  a reverse many-to-many relation inherited from a parent class (#32947).

- Fixed a regression in Django 3.2 that caused the incorrect offset
  extraction from fixed offset timezones (#32992).

https://docs.djangoproject.com/en/3.2/releases/3.2.6/
https://docs.djangoproject.com/en/3.2/releases/3.2.7/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit f71e240229)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 14:53:34 +02:00
Chris Packham
c747085a07 package/micropython: Update LICENSE info
The various micropython ports may include code licensed under different
licenses compared to the core micropython. List these in MICROPYTHON_LICENSE.

Signed-off-by: Chris Packham <judge.packham@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4dc40c21ea)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 14:45:32 +02:00
James Hilliard
d61e48e8df package/python-dateutil: bump to version 2.8.2
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7bd23d3d1e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 14:35:14 +02:00
Asaf Kahlon
e149ec9428 package/python-webob: bump to version 1.8.7
Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 548750a257)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 14:02:35 +02:00
Asaf Kahlon
a8adaf228a package/python-cffi: bump to version 1.14.6
Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 790c10d9f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 13:37:34 +02:00
Asaf Kahlon
d34fafaa73 package/python-aioconsole: bump to version 0.3.2
Plus, add LICENSE_FILES and the corresponding hash.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7f5f9618d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 13:33:42 +02:00
Fabrice Fontaine
76c433414b package/ntfs-3g: security bump to version 2021.8.22
- Fixed vulnerability threats caused by maliciously tampered NTFS
  partitions (CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, etc.):
  https://github.com/tuxera/ntfs-3g/security/advisories/GHSA-q759-8j5v-q5jp
- Drop patch (already in version)

https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-History

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 57adb82576)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 08:03:15 +02:00
Fabrice Fontaine
3f942b0c15 package/mtr: add libcap optional dependency
libcap is an optional dependency which is enabled by default since
version 0.88 and
2ff8de3102

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
(cherry picked from commit 3d99699f82)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-06 08:02:02 +02:00
Bernd Kuhls
a52b46e00e package/kodi-pvr-octonet: fix json dependency
While creating the initial package file a wrong dependency was chosen.

This package really depends on jsoncpp, not json-for-modern-cpp:
f724c5934c

This bug was found while testing per-package directories.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
(cherry picked from commit 2d8e452895)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 22:36:15 +02:00
Fabrice Fontaine
f819b0458a package/cryptopp: security bump to version 8.6.0
This release clears CVE-2021-40530 and fixes a problem with ChaCha20
AVX2 implementation. The CVE was due to ElGamal encryption using a work
estimate to size encryption exponents instead subgroup order. The
ChaCha20 issue was due to mishandling a carry in the AVX2 code path. The
ChaCha20 issue was difficult to duplicate, so most users should not
experience it.

https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_8_6_0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d714137722)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:51:15 +02:00
Fabrice Fontaine
5c34831662 package/cryptopp: bump to version 8.5.0
https://www.cryptopp.com/release850.html
https://www.cryptopp.com/release840.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 251f3e3a3f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:51:13 +02:00
Baruch Siach
b5fd0bbbad DEVELOPERS: remove Baruch Siach from openipmi
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0f6b4a67b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:48:23 +02:00
Romain Naour
9281e6c68b boot/syslinux: add missing python dependency
Syslinux use some python scripts during the build and they
are using python interpreter by default. It fail to build
when there is no python interpreter on the host.

[...]/syslinux-6.03/com32/cmenu/menugen.py
make[6]: python: No such file or directory

Since Syslinux 5.00, we can override the python interpreter
used during the build:

https://repo.or.cz/syslinux.git/commitdiff/4dec62ce9c2c0d170f21b3ae2d7c618eb7a30c05

Add the	missing	host-python3 dependency and override
it in SYSLINUX_BUILD_CMDS.

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/1614446766

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[yann.morin.1998@free.fr: fix check-package]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6ccfd40711)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:47:28 +02:00
Quentin Schulz
ad38cfabe1 boot/arm-trusted-firmware: point LICENSE_FILES to correct file
Since v2.2 release (commits 8cc36aec912 "doc: De-duplicate readme and
license files" and 9f1622b018ab "doc: Move content out of readme and
create new index page "), the license.rst file at the root of the git
repo is only telling to look at docs/license.rst file.

Let's point the ARM_TRUSTED_FIRMWARE_LICENSE_FILES to the correct file
and modify the .hash file accordingly.

The comment has also been wrong since we bumped from version 1.4 to 2.2
in commit  a757d173f1  (boot/arm-trusted-firmware: bump to version
2.2). Drop referencing an explicit version, so that is is never wrong
again.

Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
[yann.morin.1998@free.fr: also fix the comment.]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8354176915)
[Peter: update hash for v2.4]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:42:20 +02:00
Yann E. MORIN
4f44314a47 boot/mv-ddr-marvell: fix license file hash
Commit 2cfdf8b8a2 (boot/mv-ddr-marvell: Bump to HEAD as of 20201207)
forgot to update the hash a a source file that we use as license file.

Fixes: #14221

Reported-by: nyanyamiau@gmail.com
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: D. Olsson <hi@senzilla.io>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f05136090d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:31:19 +02:00
Fabrice Fontaine
34a1b25c69 package/sispmctl: bump to version 4.9
Drop patch (already in version)

https://sourceforge.net/p/sispmctl/git/ci/release-4.9/tree/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 63847a4b2e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:21:04 +02:00
Fabrice Fontaine
85e17e43c7 package/wavemon: add libcap optional dependency
libcap is an optional dependency which is enabled by default since
version 0.7.1 and
669c53e335
and can be explicitly enabled or disabled since version 0.9.0 and
af36fbe756

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit c3712a86ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 16:17:26 +02:00
Yann E. MORIN
2fd8f5bd41 fs/ext2: fix namespace for variables
In filesystems, variables must be prefixed with ROOTFS_, to avoid
ckashing with packages of the same name.

We do not have a package named 'ext2', so we currently have no clash,
but it is still better that the variables be properly namespaced.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit db7d786140)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 15:42:31 +02:00
Fabrice Fontaine
1e9392b8bb package/uboot-tools: fix static build with musl
Static build with musl fails since bump to version 2020.04 in commit
fe97212976 because LDFLAGS, which contains
-static, is not passed resulting in the following build failure:

/tmp/instance-1/output-1/host/lib/gcc/arm-buildroot-linux-musleabihf/10.3.0/../../../../arm-buildroot-linux-musleabihf/bin/ld: /tmp/instance-1/output-1/host/lib/gcc/arm-buildroot-linux-musleabihf/10.3.0/libgcc.a(_dvmd_lnx.o): in function `__aeabi_ldiv0':
/tmp/instance-1/output-1/build/host-gcc-final-10.3.0/build/arm-buildroot-linux-musleabihf/libgcc/../../../libgcc/config/arm/lib1funcs.S:1499: undefined reference to `raise'
collect2: error: ld returned 1 exit status

Fixes:
 - http://autobuild.buildroot.org/results/d71aba27ff0c7711f2cb67261183506f25217a5f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 84a2723568)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 15:29:43 +02:00
Petr Vorel
7ae5a4a9d6 utils/scanpypi: remove python2 compatibility imports
ee8b680816 ("utils/scanpypi: use python3 explicitly") started to use python3,
thus compatibility can be removed:

from __future__ import print_function
from __future__ import absolute_import

Tested with python3 -m py_compile.

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d50290764e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-05 08:19:08 +02:00
Peter Korsgaard
7c392e2bfd package/libsndfile: add security patch for CVE-2021-3246
A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile
1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.

https://nvd.nist.gov/vuln/detail/CVE-2021-3246

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit cb18218ad1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 23:56:27 +02:00
Peter Korsgaard
afe4f30e17 package/libcurl: security bump to version 7.79.1
Fixes the following security issues:

- CVE-2021-22945: UAF and double-free in MQTT sending
  When sending data to an MQTT server, libcurl could in some circumstances
  erroneously keep a pointer to an already freed memory area and both use
  that again in a subsequent call to send data and also free it again.

  https://curl.se/docs/CVE-2021-22945.html

- CVE-2021-22946: Protocol downgrade required TLS bypassed
  A user can tell curl to require a successful upgrade to TLS when speaking
  to an IMAP, POP3 or FTP server (--ssl-reqd on the command line or
  CURLOPT_USE_SSL set to CURLUSESSL_CONTROL or CURLUSESSL_ALL with libcurl).
  This requirement could be bypassed if the server would return a properly
  crafted but perfectly legitimate response.

  This flaw would then make curl silently continue its operations without
  TLS contrary to the instructions and expectations, exposing possibly
  sensitive data in clear text over the network.

  https://curl.se/docs/CVE-2021-22946.html

- CVE-2021-22947: STARTTLS protocol injection via MITM
  When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data
  securely using STARTTLS to upgrade the connection to TLS level, the server
  can still respond and send back multiple responses before the TLS upgrade.
  Such multiple "pipelined" responses are cached by curl.  curl would then
  upgrade to TLS but not flush the in-queue of cached responses and instead
  use and trust the responses it got before the TLS handshake as if they
  were authenticated.

  Using this flaw, it allows a Man-In-The-Middle attacker to first inject
  the fake responses, then pass-through the TLS traffic from the legitimate
  server and trick curl into sending data back to the user thinking the
  attacker's injected data comes from the TLS-protected server.

  Over POP3 and IMAP an attacker can inject fake response data.

  https://curl.se/docs/CVE-2021-22947.html

In addition, 7.79.1 fixes a number of regressions in 7.79.0:
https://daniel.haxx.se/blog/2021/09/22/curl-7-79-1-patched-up-and-ready/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 6d6842130b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 23:45:40 +02:00
Peter Korsgaard
5062b1e13f package/ghostscript: add upstream security patch for CVE-2021-3781
The file access protection built into Ghostscript proved insufficient for
the "%pipe%" PostScript device, when combined with Ghostscript's requirement
to be able to create and control temporary files in the conventional
temporary file directories (for example, "/tmp" or "/temp).  This exploit is
restricted to Unix-like systems (i.e., it doesn't affect Windows).  The most
severe claimed results are only feasible if the exploit is run as a "high
privilege" user (root/superuser level) \u2013 a practice we would discourage
under any circumstances.

For more details, see the advisory:
https://ghostscript.com/CVE-2021-3781.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4e415b4164)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 23:44:59 +02:00
Peter Korsgaard
61c7c12ac3 package/lynx: add security patch for CVE-2021-38165
Lynx through 2.8.9 mishandles the userinfo subcomponent of a URI, which
allows remote attackers to discover cleartext credentials because they may
appear in SNI data.

https://lists.nongnu.org/archive/html/lynx-dev/2021-08/msg00002.html

Upstream unfortunately does not provide a public VCS (only source
snapshots), so fetch the security patch from Debian.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 5bb9d79f27)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 23:44:03 +02:00
Peter Korsgaard
5387888188 package/xen: security bump to version 4.14.3
Includes a number of bugfixes and the security fixes up to xsa-384:
https://xenproject.org/downloads/xen-project-archives/xen-project-4-14-series/xen-project-4-14-3/

Drop the now upstream
0002-libs-foreignmemory-Fix-osdep_xenforeignmemory_map-prototype.patch, and
renumber the remaining patches.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 69e4493fb1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 23:43:09 +02:00
Peter Korsgaard
6cbc9ed92b package/python-pip: backport security fix for CVE-2021-3572
Backport the following security fix from the upstream 21.1 release fixing
CVE-2021-3572:

https://github.com/pypa/pip/pull/9827

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cf949134b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 23:03:58 +02:00
Thomas De Schampheleire
6365cfa960 docs/manual/using-buildroot-debugger: suggest '-ix' iso '-x' when loading gdbinit
A gdbinit file passed via '-x' will be read _after_ parsing any
object/core file passed on the command-line. In cross-compilation context,
this is particularly a problem when loading a core file, because without the
'sysroot' specified in the gdbinit file, it will give a lot of warnings,
like:

    warning: .dynamic section for "/lib/libstdc++.so.6" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/librt.so.1" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/libm.so.6" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/libgcc_s.so.1" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/libc.so.6" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/ld-linux.so.2" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/libanl.so.1" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/libdl.so.2" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/libpthread.so.0" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/usr/lib/libz.so.1" is not at the expected address (wrong library or version mismatch?)
    warning: .dynamic section for "/lib/libnss_files.so.2" is not at the expected address (wrong library or version mismatch?)

    warning: Could not load shared library symbols for 17 libraries, e.g. [...]
    Use the "info sharedlibrary" command to see the complete listing.
    Do you need "set solib-search-path" or "set sysroot"?

In contrast, the '-ix' option will load the specified gdbinit file _before_
parsing object/core files. This will remove said warnings.

See also: https://sourceware.org/bugzilla/show_bug.cgi?id=28330

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e1ee121cae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 22:22:34 +02:00
Romain Naour
801dfff468 support/testing: switch to prebuilt toolchain, core2duo to Nehalem
To avoid spending some time to build the x86_64 toolchain (~20min),
switch to corei7 cpu (Nahalem) and use the prebuilt Bootlin toolchain.

We have to use the "stable" Bootlin toolchain to use the same kernel version
for the toolchain kernel headers and the running kernel.

With the "bleeding-edge" toolchain we have the "kernel too old" issue
(running kernel 4.19 vs kernel headers 5.4)

Runtime tested locally.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 521b6f8550)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 22:05:25 +02:00
Romain Naour
8d4939c9e0 support/testing: test_openssh: use a prebuilt toolchain
Switch from the Buildroot internal toolchain for armv5 to
the prebuilt Bootlin external toolchain.

The test doesn't require to build a toolchain, there was
no prebuilt glibc toolchain recent enough at the time this
test has been introduced.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 184d20404e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 22:05:16 +02:00
Romain Naour
58dd3e695c support/testing: test_rust: remove kernel build
This test already use builtin kernel provided by the testsuite infra:

    self.emulator.boot(arch="armv7",
                       kernel="builtin",
                       options=["-initrd", img])

But a second kernel is build from the its defconfig. This second kernel
is not used by the test.

The TestRust (using BR2_PACKAGE_HOST_RUST=y) is really long to build,
save some cpu time by removing the kernel build.

This unused kernel (based on 4.11.3 release) doesn't even build with
host gcc >= 10.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit f6d438d59f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 22:05:08 +02:00
Romain Naour
3201329d6c support/testing: test_lxc bump to kernel 4.19.204
The kernel 4.19.79 curently used by the test doesn't build with host
gcc >= 10 due the gcc default -fno-common. See GCC 10 porting guide [1].

/usr/bin/ld: scripts/dtc/dtc-parser.tab.o:(.bss+0x20): multiple definition of `yylloc'; scripts/dtc/dtc-lexer.lex.o:(.bss+0x0): first defined here

The issue was fixed in 4.19.114 [2]
Bump to the latest 4.19.x version.

[1] https://gcc.gnu.org/gcc-10/porting_to.html
[2] http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=621f2ded601546119fabccd1651b1ae29d26cd38

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 883d5a2f3d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-10-04 21:16:54 +02:00