Commit Graph

40205 Commits

Author SHA1 Message Date
Peter Korsgaard
59d54e178a squashfs: do not force gzip support if lz4/xz/zstd is selected
The logic to ensure at least one compression backend is selected was not
updated when lz4, xz and zstd were introduced -  Fix that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
[Peter: add comment as suggested by Peter Seiderer]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit 84aeb4419f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 16:16:11 +01:00
Thomas Petazzoni
e7657aeaf8 package/pps-tools: bump version to fix usage without bash
As reported in bug #11426, the ppsfind shell script uses /bin/bash,
but the Buildroot pps-tools package doesn't depend on bash. In fact,
upstream has fixed the problem, and the script can now be used with a
POSIX shell, and the shebang is /bin/sh.

This commit therefore bumps pps-tools to the latest upstream commit,
which is precisely this fix.

Fixes bug #11426.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5c89726d9f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 16:05:29 +01:00
Thomas Petazzoni
a76f2dceab package/lynx: add dependency on host-pkgconf
The Lynx configure script uses pkg-config when available:

checking for nios2-buildroot-linux-gnu-pkg-config... /home/thomas/projets/buildroot/output/host/bin/pkg-config
checking pkg-config for openssl... yes
[...]
checking pkg-config for ncurses... yes

Using pkg-config avoids build failures such as:

checking for _nc_freeall... no
configure: error: Configuration does not support color-styles
make: *** [/home/test/autobuild/run/instance-1/output/build/lynx-2.8.9rel.1/.stamp_configured] Error 1

When building with "make lynx", so that pkg-config is not built
before. The issue is that in this case, lynx configure script picks up
the ncurses6-config script for the host ncurses instead of the one in
staging. Using pkg-config solves that nicely.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 67ee7f9eb1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 16:02:35 +01:00
Yann E. MORIN
21a231e104 linux: ensure images/ exist before creating files there
When using an initramfs, on the first-pass build, we create a dummy cpio
so that the build succeeeds. The real cpio will come later, and we'll do
a second-pass build to use the actual cpio.

However, when we touch that dummy cpio, the images/ directory may not
yet exist, since commit d0f4f95e39 (Makefile: rework main directory
creation logic) removed its creation at the begining of the build, to
only at the moment we need it, i.e. during the *_INSTALL_IMAGES_CMDS
steps.

However, the linux build is not a _INSTALL_IMAGES_CMDS step, so there is
no guarantee that images/ already exist at that time.

Fix that by explicitly creating images/ before touching the dummy cpio.

Reported-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Matthew Weber <matthew.weber@rockwellcollins.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 524fb10bbe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 16:01:21 +01:00
Yann E. MORIN
46433b998a package/libiscsi: do not built the manpages
The pre-rendered, bundled ones are still installed, though, but they
get removed in target-finalize anyway.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5b5c84a2a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 15:53:57 +01:00
Yann E. MORIN
fe36685e07 package/libiscsi: fix build due to warnings
Fixes:
    http://autobuild.buildroot.org/results/55b/55bf50fc7dcd465b71b5757434887dd3d0b25abc/
    http://autobuild.buildroot.org/results/98d/98dcfe5c9fc3babd5c8d3116d5128d437715c44e/

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d2d81637ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 15:51:25 +01:00
Peter Korsgaard
faa7f87936 {linux, linux-headers}: bump 4.{9, 14, 19}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 177a8a5fd9)
[Peter: drop 4.19.x, linux / hash changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 15:43:51 +01:00
Trent Piepho
9bbd9c7789 package/libcurl: use GnuTLS's default cert path
libcurl doesn't find any trust path for CA certs when it cross-compiles.
When using OpenSSL, it is explicitly configured to use the SSL cert
directory with OpenSSL style hash files in it.  But with GnuTLS, it gets
nothing.

Rather than configure libcurl to use the OpenSSL directory or a bundle
file, configure it to use the GnuTLS default.  This way the CA certs
path can be configured in one place (gnutls) and then libcurl and anyone
else who uses gnutls can default to that.

Also, when libcurl with gnutls is configured to use a directory, it ends
up loading each cert three times.

Signed-off-by: Trent Piepho <tpiepho@impinj.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 43b4d3ae45)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 15:25:12 +01:00
Trent Piepho
a32df40af6 package/gnutls: give library a default trust location
Gnutls is building with no default location to look for CA certs.  Since
there are buildroot packages to provide these, configure it to use them
by default.

Configure gnutls to find them using the bundle file which contains all
certs, rather than looking in the cert directory.  When gnutls is told
to use the directory, it loads *every* file in it.  This means it loads
the bundle with all certs, then loads each cert a second time using the
individual pem files, and then loads them all the third time via the
hash symlinks to the pem files.

When p11-kit is enabled, use its trust module instead of the bundle
file.  p11-kit can be configured to use the bundle (the default), but it
can do other things too, such as integrate with the "trust" command for
adding and removing trust anchors.

Signed-off-by: Trent Piepho <tpiepho@impinj.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 379306e8f2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-16 15:25:08 +01:00
Peter Korsgaard
82c624cd6e {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 85d00b3c8e)
[Peter: drop 4.19.x, linux / hash changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-11 08:42:08 +01:00
Waldemar Brodkorb
5c5d972941 package/uclibc: add upstream patch to fix aarch64 issues
fstatfs/statfs on aarch64 seems broken, add a patch from uClibc-ng
upstream git to fix it.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2179ca4a61)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-10 23:07:32 +01:00
Fabrice Fontaine
3f9ea4512f package/c-ares: use LICENSE.md
c-ares has a LICENSE.md file since version 1.12 and
4e861351d9

So use it instead of one of the source file and add its hash

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c9dfcbd6ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:27:59 +01:00
Peter Korsgaard
4c4c2d0bf5 glibc: bump version for post-2.26 security fixes
Fixes the following security vulnerability:

  CVE-2018-19591: A file descriptor leak in if_nametoindex can lead to a
  denial of service due to resource exhaustion when processing getaddrinfo
  calls with crafted host names.  Reported by Guido Vranken.

Adhemerval Zanella (2):
      Fix misreported errno on preadv2/pwritev2 (BZ#23579)
      x86: Fix Haswell CPU string flags (BZ#23709)

Alexandra Hájková (1):
      Add an additional test to resolv/tst-resolv-network.c

Andreas Schwab (1):
      libanl: properly cleanup if first helper thread creation failed (bug 22927)

Florian Weimer (3):
      preadv2/pwritev2: Handle offset == -1 [BZ #22753]
      conform: XFAIL siginfo_t si_band test on sparc64
      CVE-2018-19591: if_nametoindex: Fix descriptor for overlong name [BZ #23927]

Ilya Yu. Malakhov (1):
      signal: Use correct type for si_band in siginfo_t [BZ #23562]

Martin Kuchta (1):
      pthread_cond_broadcast: Fix waiters-after-spinning case [BZ #23538]

Stefan Liebler (2):
      Fix segfault in maybe_script_execute.
      Fix race in pthread_mutex_lock while promoting to PTHREAD_MUTEX_ELISION_NP [BZ #23275]

Szabolcs Nagy (1):
      i64: fix missing exp2f, log2f and powf symbols in libm.a [BZ #23822]

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:25:47 +01:00
Fabrice Fontaine
df2b72b67f php: intl support needs dynamic library
getArgTypeList is defined both in ext/intl/msgformat/msgformat_helpers.cpp
and icu library so add a !BR2_STATIC_LIBS dependency to
BR2_PACKAGE_PHP_EXT_INTL

Fixes:
 - http://autobuild.buildroot.org/results/628b677d1ceb8b404265d89357225e0a1dce1407

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f108445a3d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:22:53 +01:00
Fabrice Fontaine
e7daab236e python-numpy: fix build with lapack
If BR2_PACKAGE_LAPACK is enabled (without BR2_PACKAGE_CLAPACK), build of
python-numpy will fail if lapack is built before python-numpy because
lapack does not provide blas library

So disable BLAS and LAPACK through PYTHON_NUMPTY_ENV if
BR2_PACKAGE_CLAPACK is not set

Fixes:
 - http://autobuild.buildroot.org/results/41671976c7be7883f31ee5f51ca0eb90b81262fd

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 76815cd1e5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:19:12 +01:00
Peter Korsgaard
194c8e543e ghostscript: security bump to version 9.26
Fixes the following security vulnerabilities:

 - CVE-2018-17961: Artifex Ghostscript 9.25 and earlier allows attackers to
   bypass a sandbox protection mechanism via vectors involving errorhandler
   setup.  NOTE: this issue exists because of an incomplete fix for
   CVE-2018-17183.

- CVE-2018-18284: Artifex Ghostscript 9.25 and earlier allows attackers to
  bypass a sandbox protection mechanism via vectors involving the 1Policy
  operator.

- CVE-2018-19409: An issue was discovered in Artifex Ghostscript before
  9.26.  LockSafetyParams is not checked correctly if another device is
  used.

- CVE-2018-19475: psi/zdevice2.c in Artifex Ghostscript before 9.26 allows
  remote attackers to bypass intended access restrictions because available
  stack space is not checked when the device remains the same.

- CVE-2018-19476: psi/zicc.c in Artifex Ghostscript before 9.26 allows
  remote attackers to bypass intended access restrictions because of a
  setcolorspace type confusion.

- CVE-2018-19477: psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows
  remote attackers to bypass intended access restrictions because of a
  JBIG2Decode type confusion.

For more details, see the release notes:
https://www.ghostscript.com/doc/9.26/History9.htm#Version9.26

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e52b02677a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:09:59 +01:00
Peter Seiderer
e1f45e9464 freetype: bump version to 2.9.1
According to [1]:

- fixes CVE-2018-6942: A NULL pointer dereference in the Ins_GETVARIATION()
  function within ttinterp.c could lead to DoS via a crafted font file

- needs '--enable-freetype-config' for freetype-config installation

[1] https://git.savannah.gnu.org/cgit/freetype/freetype2.git/tree/docs/CHANGES?id=86bc8a95056c97a810986434a3f268cbe67f2902

[Peter: also pass --enable-freetype-config for host variant]
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit 750d43ae14)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:07:45 +01:00
Bernd Kuhls
daef1c454f package/freetype: bump version to 2.9
Changelog:
https://sourceforge.net/projects/freetype/files/freetype2/2.9/

Upstream changed its project URL to https in docs/FTL.TXT. We do the
same in Config.in and update the license hash for docs/FTL.TXT.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0d386f8847)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:05:57 +01:00
Peter Korsgaard
23b8a2139a libopenssl: security bump to version 1.0.2q
Fixes the following security vulnerabilities:

  *) Microarchitecture timing vulnerability in ECC scalar multiplication

     OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been
     shown to be vulnerable to a microarchitecture timing side channel attack.
     An attacker with sufficient access to mount local timing attacks during
     ECDSA signature generation could recover the private key.

     This issue was reported to OpenSSL on 26th October 2018 by Alejandro
     Cabrera Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and
     Nicola Tuveri.
     (CVE-2018-5407)
     [Billy Brumley]

  *) Timing vulnerability in DSA signature generation

     The OpenSSL DSA signature algorithm has been shown to be vulnerable to a
     timing side channel attack. An attacker could use variations in the signing
     algorithm to recover the private key.

     This issue was reported to OpenSSL on 16th October 2018 by Samuel Weiser.
     (CVE-2018-0734)
     [Paul Dale]

For more information, see the changelog:
https://www.openssl.org/news/cl102.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3301b6e1b2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:03:30 +01:00
Florian Fainelli
eb2a89acb0 xfsprogs: Define PLATFORM to linux
PLATFORM is an environment variable used by xfsprogs' configure script
to determine the platform for which the applications are being built. If
we set some incorrect/unsupported value through e.g: export, this will
be picked up by xfsprogs' configure script and used as-is and assigned
to PKG_PLATFORM, which will lead to build failures.

If PLATFORM was empty/unset, then uname on the host building xfsprogs
gets used to determine the build platform, which again could be
incorrect if we e.g: built xfsprogs on a Darwin system.

Since we are obviously building for Linux, let's just make sure we
define it that way which solves both issues.

Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 257a2118be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 23:02:07 +01:00
Peter Korsgaard
7d708397a9 samba4: security bump to version 4.8.7
Fixes the following security vulnerabilities:

 - CVE-2018-14629:
   All versions of Samba from 4.0.0 onwards are vulnerable to infinite
   query recursion caused by CNAME loops. Any dns record can be added via
   ldap by an unprivileged user using the ldbadd tool, so this is a
   security issue.

 - CVE-2018-16841:
   When configured to accept smart-card authentication, Samba's KDC will call
   talloc_free() twice on the same memory if the principal in a validly signed
   certificate does not match the principal in the AS-REQ.

   This is only possible after authentication with a trusted certificate.

   talloc is robust against further corruption from a double-free with
   talloc_free() and directly calls abort(), terminating the KDC process.

   There is no further vulnerability associated with this issue, merely a
   denial of service.

 - CVE-2018-16851:
   During the processing of an LDAP search before Samba's AD DC returns
   the LDAP entries to the client, the entries are cached in a single
   memory object with a maximum size of 256MB.  When this size is
   reached, the Samba process providing the LDAP service will follow the
   NULL pointer, terminating the process.

   There is no further vulnerability associated with this issue, merely a
   denial of service.

 - CVE-2018-16853:
   A user in a Samba AD domain can crash the KDC when Samba is built in the
   non-default MIT Kerberos configuration.

   With this advisory we clarify that the MIT Kerberos build of the Samba
   AD DC is considered experimental.  Therefore the Samba Team will not
   issue security patches for this configuration.

For more details, see the release notes:

https://www.samba.org/samba/history/samba-4.8.7.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 22:58:05 +01:00
Bernd Kuhls
2614104752 package/samba4: bump version to 4.8.5
Release notes: https://www.samba.org/samba/history/samba-4.8.5.html

Rebased patches 0001 & 0004.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 934d23bec7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 22:57:58 +01:00
Fabrice Fontaine
0172a94ac5 popt: add libiconv to popt.pc.in
Add ${LTLIBICONV} to popt.pc.in so applications such as shairport-sync
will know that they must link with -liconv when building statically

Fixes:
 - http://autobuild.buildroot.org/results/c5b0d1d2867e49c022a2ad971dd9f358ff0f3865

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 1209eb2dca)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 22:53:25 +01:00
Fabrice Fontaine
dca53990a0 msgpack: disables tests
tests are enabled if gperf and zlib are found and they fail on:
/home/buildroot/autobuild/run/instance-0/output/build/msgpack-2.1.5/include/msgpack/v1/object.hpp:652:34:
error: 'void* memcpy(void*, const void*, size_t)' copying an object of non-trivial type 'struct msgpack::v2::object' from an array of 'const msgpack_object' {aka 'const struct msgpack_object'} [-Werror=class-memaccess]
     std::memcpy(&o, &v, sizeof(v));

So disable them.

Fixes:
 - http://autobuild.buildroot.org/results/7d7aa9723f02f9bc78dbf6248674be4d402199bf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d2d75e07db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 22:52:19 +01:00
Yann E. MORIN
f00bc4994e package/libid3tag: needs autoreconf
libid3tag uses a very old configure script.

When the toolchain lacks C++ and the build machine lacks /lib/cpp, this
old configure script fails because it can't find a C++ preprocessor that
is valid:

    checking for arm-buildroot-linux-uclibcgnueabi-g++... no
    checking whether we are using the GNU C++ compiler... no
    checking whether no accepts -g... no
    checking dependency style of no... none
    checking how to run the C++ preprocessor... /lib/cpp
    configure: error: C++ preprocessor "/lib/cpp" fails sanity check
    See `config.log' for more details.

This is yet another case that was tentatively fixed by bd39d11d2e
(core/infra: fix build on toolchain without C++), further amended by
4cd1ab1588 (core: alternate solution to disable C++).

However, this only works on libtool scripts that are recent enough, and
thus we need to autoreconf to get it.

We also need to patch configure.ac so that it does not fail on the
missing, GNU-specific files: NEWS, AUTHORS, and Changelog.

Fixes:
    http://autobuild.buildroot.org/results/ac3/ac3870208aab6001db6b790b6c5dde64d08f7669/
    http://autobuild.buildroot.org/results/cc1/cc18397f38dfd4f1e6605f7a6f58edab49b396ac/

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 43274dd3e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 22:51:05 +01:00
Yann E. MORIN
1cef40d5c1 package/dante: needs autoreconf
We have a patch that touches a .m4 file, so we need to regenerate the
configure script. Otherwise, this is done during the build step, and
some environment variables are thus missing and the build may fail when
the host machine does not have the expected autostuff tools.

Fixes:
    http://autobuild.buildroot.org/results/e37/e37e61bae1d81a7956e2843be70fea84b0bbb64b/
    http://autobuild.buildroot.org/results/f96/f969718402cae71446d6280ec1f66d357a155293/
    ...

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 83d1902812)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 22:46:51 +01:00
Fabrice Fontaine
93d0a413d5 dante: disable pam
Fixes:
 - http://autobuild.buildroot.org/results/5222592f2052e18c184fae42214c112e7f39be6e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 982805a32b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-12-03 22:46:47 +01:00
Peter Korsgaard
d047c4032b Update for 2018.02.8
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 23:41:24 +01:00
Adrian Perez de Castro
9037ebe8b5 package/webkitgtk: bump to version 2.22.4
This is a maintenance release of the current stable WebKitGTK+ version,
which contains security fixes for  CVE-2018-4345, CVE-2018-4372,
CVE-2018-4373, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378,
CVE-2018-4382, CVE-2018-4386, CVE-2018-4392, and CVE-2018-4416.
Additionally, it fixes a few build failures, and a crash when using
certain version of Cairo.

Release notes can be found in the announcement:

  https://webkitgtk.org/2018/11/21/webkitgtk2.22.4-released.html

More details on the issues covered by security fixes can be found
in the corresponding security advisory:

  https://webkitgtk.org/security/WSA-2018-0008.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7a827a17dc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 19:02:19 +01:00
Fabrice Fontaine
e718e4241f package/samba4: fix install of systemd files
Since version 4.8.0 and
080d590de1,
the systemd files (nmd.service, ...) are not available in packaging/systemd

Indeed, they are built in bin/default/packaging/systemd

So use the new --systemd-install-services configure option to install
these files

Fixes:
 - http://autobuild.buildroot.org/results/a09a065c523931c1892e81a99c57521fbe095d8b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ea5280b889)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 19:01:39 +01:00
Fabrice Fontaine
aa8d13d70e package/usb_modeswitch: disable parallel build
Build of package will sometime fails because of the following issue:
install-static target has two dependencies: dispatcher-static and
install-common

Because dispatcher-static is not a file but only a target, it will
always be called to build usb_modeswitch_dispatcher.
So, even if install-common depends on usb_modeswitch_dispatcher, in some
rare cases, install-static won't be able to install
usb_modeswitch_dispatcher because it is being rebuild by
dispatcher-static

To fix this issue, disable parallel build

Fixes:
 - http://autobuild.buildroot.org/results/8297be35725b816ff5afaf909605ceb41223efb6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a554109af8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 18:57:16 +01:00
Bernd Kuhls
f4c3937cdf {linux, linux-headers}: bump 4.{4, 9, 14, 18}.x series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0021a2a49f)
[Peter: drop 4.18.x, linux / hash changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 18:52:15 +01:00
Yann E. MORIN
81c273d174 support/graph-depends: fix package names starting with a non-alpha
Graphviz' dot utility does not like nodes which names does not start
with an ^[[:alpha:]], i.e. 18xx-ti-utils would cause grievance:

    Warning: syntax ambiguity - badly delimited number '18x' in line 4 [...]/graph-depends.dot splits into two tokens
    Warning: syntax ambiguity - badly delimited number '18x' in line 5 [...]/graph-depends.dot splits into two tokens
    Warning: syntax ambiguity - badly delimited number '18x' in line 6 [...]/graph-depends.dot splits into two tokens
    Warning: syntax ambiguity - badly delimited number '18x' in line 7 [...]/graph-depends.dot splits into two tokens

Prefix nodes with an underscore to fix that.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 020206ca57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 18:49:35 +01:00
Andreas Naumann
1353c0c8e2 linux: Make dtc install step more reliable
Checking for the existence of the dtc binary built by the
non-dependent dtc package may cause instable behaviour when giving more
freedom on the order of how the packages are built (parallelization).

In addidion, when moving to per-package host/target method, the check
would always trigger in the isolated host, leading to linux-dtc always
being installed as dtc.
This in turn may lead to undesired overwriting of the real host-dtc binary
when finally assembling the global host dir.

Thus rework the linux-dtc install condition to be defined by configuration
rather than compile time order.

Signed-off-by: Andreas Naumann <anaumann@ultratronik.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 860906ee05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 18:46:54 +01:00
Peter Korsgaard
311f62435b prosody: security bump to version 0.9.14
This fixes a cross-host authentication vulnerability, CVE-2018-10847.
The issue affects Prosody instances that have multiple virtual hosts
(including anonymous authenticated hosts):
https://blog.prosody.im/prosody-0-10-2-security-release

A full security advisory is available at
https://prosody.im/security/advisory_20180531

Compute hashes locally as they are no more available on
https://prosody.im/downloads/source/{MD5,SHA1,SHA256,SHA512}SUMS

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 18:07:41 +01:00
Thomas Petazzoni
1d84214699 configs/armadeus_apf27: fix U-Boot configuration
The U-Boot part of the defconfig was not specifying explicitly any
U-Boot version. Since commit 21e3ae8a18
("boot/uboot: default to kconfig buildsystem for latest version"), we
default to using the kconfig build system when the default U-Boot
version is used. Following this change, the apf27 defconfig therefore
started using kconfig, for which the BR2_TARGET_UBOOT_BOARDNAME
Config.in option is not used. Due to this, the build fails with:

boot/uboot/uboot.mk:411: *** No board defconfig name specified, check your BR2_TARGET_UBOOT_BOARD_DEFCONFIG setting.  Stop.

Indeed, when Kconfig is used, the board defconfig must be specified
with BR2_TARGET_UBOOT_BOARD_DEFCONFIG.

As part of fixing this, we also set a fixed U-Boot version for this
defconfig, like we do in all other defconfigs.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/123771003

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a8aaee72a7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 18:02:03 +01:00
Thomas Petazzoni
743df43a35 configs/imx6-sabresd_qt5: add missing dependency on host-openssl
host-openssl is needed to build the Linux kernel. This is the same
issue that was fixed in commit
5dac3b9b8d ("configs/imx6-sabresd: needs
host-openssl for the Linux kernel build") for the minimal defconfig
for the same board.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/123771070

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c32608ba39)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:59:50 +01:00
Fabio Estevam
cc0bc0f913 configs/imx6sabre: Create distinct pre-processed mkimage config files
Commit 0c4bccf9e8 ("configs/imxsabre: Fix U-Boot parallel build issue")
tried to fix the parallel build issue, but the real fix was developed
later by Trent Piepho later, so add such commit to fix Buildroot
build failures on rel_imx_4.9.x_1.0.0_ga NXP branch.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/123771053
https://gitlab.com/buildroot.org/buildroot/-/jobs/123771054
https://gitlab.com/buildroot.org/buildroot/-/jobs/123771055

Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1ad9c45a05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:57:09 +01:00
Fabrice Fontaine
7da0365553 gauche: fix parallel build
Add a patch to fix parallel build issue on ext/rfc

Fixes:
 - http://autobuild.buildroot.org/results/f4935e29ce6aaebdaa47d46c56120b7e97145d1b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e00369fa84)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:28:38 +01:00
Yann E. MORIN
668e4b1ab0 fs/tar: add support for xattrs (thus capabilties)
By default, tar will not include any extended attribute (xattr) when
creating archives, and thus will not store capabilties either (as they
are stored in the xattr 'security.capability').

Using option --xattrs is enough to create a tarball with all the xattrs
attached to a file. However, extracting all xattrs from a tarball
requires that --xattrs-include='*' be used. This is not symetric (but on
purpose, as per the documentation), and so is confusing to some.

So, we use --xattrs-include='*' to create the archive, so as to be
explicit that we want all xattrs to be stored.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6d688e2132)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:24:45 +01:00
Thomas Claveirole
8603656ec8 package/netplug: fix quoting of ${NETWORKING} in init script
Since 4adaa581b2, S29netplug looks for
/etc/default/network instead of /etc/sysconfig/network.  When this
file exists but does not define $NETWORKING, the script fails on line
29 with something like:

/etc/init.d/S29netplug: 29: [: =: unexpected operator

Fix quoting so this error no longer happens.

Signed-off-by: Thomas Claveirole <thomas.claveirole@green-communications.fr>
[Thomas: keep double quotes around "no", keep curly braces when
referencing the variable.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit 5682ba9363)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:21:27 +01:00
Serj Kalichev
a039dd082d package/pkg-generic.mk: fix show-build-order stdout pollution
The commands like "make show-build-order" or "make
<package>-show-build-order" show the build order and then print
"make[1]: Nothing to be done for 'show-build-order'" to stdout. It
pollutes output. Technically this message is true but it's not true
for user because he gets an information.

The <package>-show-build-order targets use $(info) for package name
printing.  The make utility doesn't consider the internal directive as
a command so it think that it's "Nothing to be done". The patch adds
the empty command to <package>-show-build-order to inform make utility
that taget makes some real actions.

Signed-off-by: Serj Kalichev <serj.kalichev@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
[Thomas: invert $(info) and @:, as suggested by Yann.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit 75c81a12f6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:19:02 +01:00
Carlos Santos
5edb7ab4e4 vtun: remove reference to start-stop-daemon from package help
None of the other 82 packages that use start-stop-daemon does this.

Signed-off-by: Carlos Santos <casantos@datacom.com.br>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 11d96cdeb9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:18:39 +01:00
Grzegorz Blach
8771409fa8 package/webkitgtk: use proper USE_WOFF2 flag instead of ENABLE_WOFF2
Signed-off-by: Grzegorz Blach <grzegorz@blach.pl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ef3deade61)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:17:19 +01:00
Thomas Petazzoni
54f7565eb2 rpm: really take DEPENDENCIES into account
Commit e7af4033c3 ("rpm: use the new
gettext logic") introduced a really nasty bug: by adding
$(TARGET_NLS_DEPENDENCIES) to RPM_DEPENDENCIES, it completely
overwrote the existing value of RPM_DEPENDENCIES, entirely masking all
mandatory RPM dependencies.

rpm is fairly towards the end of the alphabet, and most other
mandatory dependencies (berkeleydb, host-pkgconf, file and popt)
appear earlier by alphabetic ordering. Only zlib was afterwards, but
since file depends on zlib, it was always built before. This probably
explains why our autobuilders haven't encountered a single build
failure.

However, a simple "make rpm" clearly exhibits the failure, and
obviously the upcoming per-package folder mechanism makes such bugs
even more obvious.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 36385f87f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:15:49 +01:00
Yann E. MORIN
3f14fed1de core: ensure we use the realpath(3) of DL_DIR
When $(TOPDIR)/dl is a symlink, checking out git submodules can fail,
as reported by Michael in #11086.

To reproduce a similarly-related mis-behaviour:

    $ mkdir -p foo/bar foo/buz
    $ cd foo/bar
    $ ln -s ../buz meh
    $ cd meh
    $ cd ../../foo

The last command should not succeed, because, relative to meh, there is
no ../../foo directory; we would expect it to be ../../../foo, instead.
But since meh is a symlink to a directory, then a relative path from that
symlink is interpreted as relative to the derefrenced directory, i.e.
from buz in this case.

But where this gets even weirder, is that, if the last command is
replaced by:

    $ cd ../../../foo

then it still works, too.

And that is the root of Michael's issue: the dl directory in Buildroot's
TOPDIR is a symlink to a similarly-named directory one directory higher,
which then confuses relative paths, which gets especially and noticeably
bad for git submodules.

Avoid this strangeness, and just use so-called "physical" path, i.e. a
path where all symlinks to directories have been dereferenced.

Fixes: #11086

Reported-by: Michael Nosthoff <posted@heine.so>
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Michael Nosthoff <posted@heine.so>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 632e164a19)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 17:14:36 +01:00
Peter Korsgaard
387a72cc16 mosquitto: fix build on uClibc
Fixes:
http://autobuild.buildroot.net/results/c42/c425eb496cc5422ff1e2e51e59d4baf377bcbeed/

The memory tracking feature of mosquitto (which is enabled by default on
systems defining __GLIBC__) uses malloc_usable_size() which was only added
to uClibc-ng in 1.0.29.

2018.02.x still uses 1.0.28, so disable this feature when building on
uClibc.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 12:51:26 +01:00
Serj Kalichev
371498e002 fs/common.mk: Fix show-build-order
The command "make show-build-order" doesn't show dependencies of rootfs-common target.

This patch adds $(ROOTFS_COMMON_DEPENDENCIES) to PACKAGES variable.

Signed-off-by: Serj Kalichev <serj.kalichev@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 305e4487e5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 12:49:26 +01:00
Thomas Petazzoni
cd7fa21864 utils/genrandconfig: add missing new line when creating the configuration
When adding the custom BR2_WGET value in the configuration,
genrandconfig forgets to add a newline. Due to this, the next option
that is added is printed on the same line as BR2_WGET="", which causes
it to be ignored.

Due to this, in all builds, the line right after BR2_WGET was
ignored. It could have been BR2_ENABLE_DEBUG, BR2_INIT_BUSYBOX,
BR2_INIT_SYSTEMD, BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV,
BR2_STATIC_LIBS or BR2_PACKAGE_PYTHON_PY_ONLY depending on the
randomization.

Fix that by adding a proper newline at the end of the BR2_WGET option.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3eb49f59d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 12:48:13 +01:00
Fabrice Fontaine
353477440b easydbus: fix build without C++
Specify that easydbus is a C project file otherwise build will fail if
no C++ compiler is found by cmake

Fixes:
 - http://autobuild.buildroot.org/results/486c3cd98124e7415dee2fd1463bd5e0fcc9ba91

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e8fc4364a4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2018-11-26 12:47:44 +01:00