Commit Graph

63556 Commits

Author SHA1 Message Date
Bernd Kuhls
5f1df54d4d package/freeswitch: security bump version to 1.10.9
Release notes:
https://github.com/signalwire/freeswitch/releases/tag/v1.10.9

Upstream removed zrtp support:
https://github.com/signalwire/freeswitch/pull/1848

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 46683dd4a6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:01 +01:00
Bernd Kuhls
fdc283c0b1 package/freeswitch: bump version to 1.10.8
Release notes:
https://github.com/signalwire/freeswitch/releases/tag/v1.10.8

Removed two patches which are included in upstream release,
renumbered remaining patch.

Removed libs/apr-util/LICENSE due to upstream removal of bundled
apr-util package.

Added fix to disable pcap detection, otherwise /usr/bin/pcap-config
can be picked-up which breaks building freeswitch.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1b8230ab64)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:01 +01:00
Fabrice Fontaine
016b0adec1 package/freeswitch: fix build with libressl >= 3.5.0
Fix the following build failure with libressl raised since bump to
version 3.5.2 in commit 8b216927db:

crypto/hash/hmac_ossl.c: In function 'srtp_hmac_alloc':
crypto/hash/hmac_ossl.c:88:55: error: invalid application of 'sizeof' to incomplete type 'HMAC_CTX' {aka 'struct hmac_ctx_st'}
   88 |         pointer = (uint8_t *)srtp_crypto_alloc(sizeof(HMAC_CTX) +
      |                                                       ^~~~~~~~
crypto/hash/hmac_ossl.c:97:9: warning: implicit declaration of function 'HMAC_CTX_init'; did you mean 'HMAC_CTX_new'? [-Wimplicit-function-declaration]
   97 |         HMAC_CTX_init(new_hmac_ctx);
      |         ^~~~~~~~~~~~~
      |         HMAC_CTX_new
crypto/hash/hmac_ossl.c: In function 'srtp_hmac_dealloc':
crypto/hash/hmac_ossl.c:130:5: warning: implicit declaration of function 'HMAC_CTX_cleanup' [-Wimplicit-function-declaration]
  130 |     HMAC_CTX_cleanup(hmac_ctx);
      |     ^~~~~~~~~~~~~~~~
crypto/hash/hmac_ossl.c:133:40: error: invalid application of 'sizeof' to incomplete type 'HMAC_CTX' {aka 'struct hmac_ctx_st'}
  133 |     octet_string_set_to_zero(a, sizeof(HMAC_CTX) + sizeof(srtp_auth_t));
      |                                        ^~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/e696ead9ffffa5bb80928d75607bfbb9b263d3c6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e4a762bf7f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:00 +01:00
Bernd Kuhls
ab94614e7d package/sofia-sip: bump version to 1.13.12
Switch to github helper due to lack of upstream-provided tarball.

Needed for upcoming bump of freeswitch to version 1.10.9.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8bb962724e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:00 +01:00
Bernd Kuhls
a206365859 package/sofia-sip: bump version to 1.13.9
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6c33056fff)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:00 +01:00
Bernd Kuhls
a3bc915b74 package/libks: bump version to 1.8.2
Needed for upcoming bump of freeswitch to version 1.10.9.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6e09e7987b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:00 +01:00
Fabrice Fontaine
2461817ad6 package/libks: disable tests
Disables tests to avoid the following build failure with
BR2_SHARED_STATIC_LIBS:

[ 42%] Linking C executable teststring
../libks.so.1: undefined reference to `dlsym'

Fixes:
 - http://autobuild.buildroot.org/results/e61a683928795402375165adf686687f3305e0c2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 267e39413e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:00 +01:00
Bernd Kuhls
a1a765f815 package/libks: bump version to 1.8.0
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 065750ee0c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:59:00 +01:00
Sergey Organov
f7d8ba50f6 package/openvpn: get rid of -e in S60openvpn shebang
The -e switch makes the script terminate on error from
start-stop-daemon, rendering unreachable the code that checks the exit
status.

There is no need in the -e switch in the first place either, as the
script takes care of errors handling.

Signed-off-by: Sergey Organov <sorganov@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 28ca1da234)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:16:17 +01:00
Peter Korsgaard
b712193b42 {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.1.x series
4.9.x / 6.0.x is now EOL.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit def789059a)
[Peter: drop 6.1.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 17:14:56 +01:00
Fabrice Fontaine
ef65baf8e2 package/vim: security bump to version 9.0.1260
- Fix CVE-2023-0049, CVE-2023-0051, CVE-2023-0054 and CVE-2023-0288
- Update hash of README.txt: typo fixed by
  f1dcd14fc5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 98f8ddbc74)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 16:32:16 +01:00
Fabrice Fontaine
782f193f0f package/c-ares: security bump to version 1.19.0
Low. Stack overflow in ares_set_sortlist() which is used during c-ares
initialization and typically provided by an administrator and not an end
user.

https://c-ares.org/changelog.html#1_19_0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 121a9d3649)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 16:32:10 +01:00
Peter Korsgaard
a74860f35d package/sdl2: backport upstream security fix for CVE-2022-4743
Fixes the following security vulnerability:

CVE-2022-4743: A potential memory leak issue was discovered in SDL2 in
GLES_CreateTexture() function in SDL_render_gles.c.  The vulnerability
allows an attacker to cause a denial of service attack.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 15:19:25 +01:00
Bernd Kuhls
a5240ca499 package/kodi: fix riscv build
Fixes build error not yet found by autobuilders

-- System type: Linux
CMake Error at cmake/scripts/linux/ArchSetup.cmake:42 (message):
  Unknown CPU: riscv32

using this defconfig:

BR2_riscv=y
BR2_RISCV_32=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 39886a434a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 15:01:17 +01:00
Bernd Kuhls
873c996fc8 package/kodi: fix openrisc build
Fixes build error not yet found by autobuilders

-- System type: Linux
CMake Error at cmake/scripts/linux/ArchSetup.cmake:42 (message):
  Unknown CPU: or1k

with this defconfig:

BR2_or1k=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_OPENRISC_UCLIBC_STABLE=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 86fac589fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 15:01:04 +01:00
Bernd Kuhls
198e35ddab package/kodi: fix armv5 build
Disable neon support when not available.

Fixes build error not yet found by autobuilders

/tmp/cc8LvPwi.s: Assembler messages:
/tmp/cc8LvPwi.s:28: Error: selected processor does not support `vldmia r1,{ q4-q7 }' in ARM mode
/tmp/cc8LvPwi.s:29: Error: selected processor does not support `vldmia r0,{ q8-q11 }' in ARM mode
/tmp/cc8LvPwi.s:30: Error: selected processor does not support `vmul.f32 q0,q8,d8[0]' in ARM mode
/tmp/cc8LvPwi.s:31: Error: selected processor does not support `vmul.f32 q1,q8,d10[0]' in ARM mode
/tmp/cc8LvPwi.s:32: Error: selected processor does not support `vmul.f32 q2,q8,d12[0]' in ARM mode
/tmp/cc8LvPwi.s:33: Error: selected processor does not support `vmul.f32 q3,q8,d14[0]' in ARM mode
/tmp/cc8LvPwi.s:34: Error: selected processor does not support `vmla.f32 q0,q9,d8[1]' in ARM mode
/tmp/cc8LvPwi.s:35: Error: selected processor does not support `vmla.f32 q1,q9,d10[1]' in ARM mode
/tmp/cc8LvPwi.s:36: Error: selected processor does not support `vmla.f32 q2,q9,d12[1]' in ARM mode
/tmp/cc8LvPwi.s:37: Error: selected processor does not support `vmla.f32 q3,q9,d14[1]' in ARM mode
/tmp/cc8LvPwi.s:38: Error: selected processor does not support `vmla.f32 q0,q10,d9[0]' in ARM mode
/tmp/cc8LvPwi.s:39: Error: selected processor does not support `vmla.f32 q1,q10,d11[0]' in ARM mode
/tmp/cc8LvPwi.s:40: Error: selected processor does not support `vmla.f32 q2,q10,d13[0]' in ARM mode
/tmp/cc8LvPwi.s:41: Error: selected processor does not support `vmla.f32 q3,q10,d15[0]' in ARM mode
/tmp/cc8LvPwi.s:42: Error: selected processor does not support `vmla.f32 q0,q11,d9[1]' in ARM mode
/tmp/cc8LvPwi.s:43: Error: selected processor does not support `vmla.f32 q1,q11,d11[1]' in ARM mode
/tmp/cc8LvPwi.s:44: Error: selected processor does not support `vmla.f32 q2,q11,d13[1]' in ARM mode
/tmp/cc8LvPwi.s:45: Error: selected processor does not support `vmla.f32 q3,q11,d15[1]' in ARM mode
/tmp/cc8LvPwi.s:46: Error: selected processor does not support `vstmia r0,{ q0-q3 }' in ARM mode

with this defconfig:

BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV5_EABI_UCLIBC_STABLE=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2952832a40)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 13:59:49 +01:00
Fabrice Fontaine
399ca20e6b package/lxc: fix CVE-2022-47952
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may
allow local users to infer whether any file exists, even within a
protected directory tree, because "Failed to open" often indicates that
a file does not exist, whereas "does not refer to a network namespace
path" often indicates that a file exists. NOTE: this is different from
CVE-2018-6556 because the CVE-2018-6556 fix design was based on the
premise that "we will report back to the user that the open() failed but
the user has no way of knowing why it failed"; however, in many
realistic cases, there are no plausible reasons for failing except that
the file does not exist.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-06 22:42:59 +01:00
Fabrice Fontaine
c2284f82ec package/python-future: security bump to version 0.18.3
Fix CVE-2022-40899: An issue discovered in Python Charmers Future 0.18.2
and earlier allows remote attackers to cause a denial of service via
crafted Set-Cookie header from malicious web server.

https://github.com/PythonCharmers/python-future/releases/tag/v0.18.3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 51eb81ddcf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-06 00:01:29 +01:00
Nicolas Cavallari
66cec4d25c package/libgit2: security bump to 1.5.1
Fixes CVE-2023-22742: when compiled with BR2_PACKAGE_LIBSSH2,
libgit2 fails to verify SSH keys by default.

https://github.com/libgit2/libgit2/blob/v1.5.1/docs/changelog.md

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cc47da516c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:47 +01:00
Nicolas Cavallari
3a7e02bdfd package/libgit2: bump to 1.5.0
It includes an option to build a command line program that can be used
to replace git in simple cases.

The upcoming sha256 repository support made them steal the sha256 code
from RFC6234, hence the license change.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7c8e34f4d2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:39 +01:00
Nicolas Cavallari
6b1a7b69ab package/libgit2: link with -latomic if needed
libgit2 is currently a library without any reverse dependencies so the
missing atomic symbols do not cause build failures yet.

libgit2 uses the atomics intrinsics on gcc >= 4.7 and the sync
intrinsics on previous gcc versions.  Since gcc 4.9 is the new
minimum, ignore the sync intrinsics requirements.

The next version of libgit2 will also build a binary, which will
expose the problem.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e992a3e771)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:31 +01:00
Nicolas Cavallari
89c63ae872 package/libgit2: bump version to 1.4.3
git added restrictions on config files to fix CVE 2022-24765.  libgit2
adopted these changes for compatibility reasons, even if the vuln is
not exploitable in libgit2.

https://github.com/libgit2/libgit2/releases/tag/v1.4.3

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 01ee7f84fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:25 +01:00
Nicolas Cavallari
0683331971 package/libgit2: bump version to 1.4.2
Licence changes mostly concern vendored dependencies (that buildroot does
not use) and a new bundled PRNG used to reimplement mkstemp() - added
CC0 license for that.

Some buildsystem options also changed:
- THREADSAFE is now USE_THREADS
- BUILD_CLAR is now BUILD_TESTS, which the cmake infra already give.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ba8c268e00)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:19 +01:00
Joachim Wiberg
3909dfbb81 package/ssdp-responder: fix misspelled define directive
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6e0ba6bfc2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 13:30:51 +01:00
Peter Korsgaard
70485003c5 package/git: security bump to version 2.31.6
Fixes the following security issues:

 * CVE-2022-41903:

   git log has the ability to display commits using an arbitrary
   format with its --format specifiers. This functionality is also
   exposed to git archive via the export-subst gitattribute.

   When processing the padding operators (e.g., %<(, %<|(, %>(,
   %>>(, or %><( ), an integer overflow can occur in
   pretty.c::format_and_pad_commit() where a size_t is improperly
   stored as an int, and then added as an offset to a subsequent
   memcpy() call.

   This overflow can be triggered directly by a user running a
   command which invokes the commit formatting machinery (e.g., git
   log --format=...). It may also be triggered indirectly through
   git archive via the export-subst mechanism, which expands format
   specifiers inside of files within the repository during a git
   archive.

   This integer overflow can result in arbitrary heap writes, which
   may result in remote code execution.

 * CVE-2022-23521:

    gitattributes are a mechanism to allow defining attributes for
    paths. These attributes can be defined by adding a `.gitattributes`
    file to the repository, which contains a set of file patterns and
    the attributes that should be set for paths matching this pattern.

    When parsing gitattributes, multiple integer overflows can occur
    when there is a huge number of path patterns, a huge number of
    attributes for a single pattern, or when the declared attribute
    names are huge.

    These overflows can be triggered via a crafted `.gitattributes` file
    that may be part of the commit history. Git silently splits lines
    longer than 2KB when parsing gitattributes from a file, but not when
    parsing them from the index. Consequentially, the failure mode
    depends on whether the file exists in the working tree, the index or
    both.

    This integer overflow can result in arbitrary heap reads and writes,
    which may result in remote code execution.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 13:04:18 +01:00
Bernd Kuhls
fe8c4143f7 package/x11r7/xlib_libXpm: security bump version to 3.5.15
Release notes:
https://lists.x.org/archives/xorg-announce/2023-January/003313.html

Fixes CVE-2022-4883, CVE-2022-44617 & CVE-2022-46285:
https://lists.x.org/archives/xorg-announce/2023-January/003312.html

Updated license hash due to upstream commit:
501494c6c6

Added configure option to disable compressed pixmaps support:
4841039e53

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a0dfd717f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 11:48:58 +01:00
Bernd Kuhls
c9c714a24a package/x11r7/xlib_libXpm: bump version to 3.5.14
https://lists.x.org/archives/xorg-announce/2022-November/003261.html
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7d2fff7804)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 11:48:52 +01:00
Yair Ben-Avraham
b299ee5f40 package/sudo: security bump to version 1.9.12p2
Fix https://nvd.nist.gov/vuln/detail/CVE-2023-22809

Signed-off-by: Yair Ben-Avraham <yairba@protonmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 51e98499ff)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:29:35 +01:00
Francois Perrad
e2914938c9 package/sudo: bump to version 1.9.12p1
remove merged patch

diff LICENSE.md
-    Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler
+    Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler
-    Copyright (c) 2008-2018, Dave Benson and the protobuf-c authors.
+    Copyright (c) 2008-2022, Dave Benson and the protobuf-c authors.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f095f5a8be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:29:26 +01:00
Fabrice Fontaine
677fbb43b7 package/sudo: bump to version 1.9.11p2
License file renamed and year updated with
0ed92e6165
d02ba52fa4

https://www.sudo.ws/releases/stable/#1.9.11p2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9b7f8da96b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:29:08 +01:00
Bernd Kuhls
080ad9aeda package/apache: security bump version to 2.4.55
Release notes:
https://lists.apache.org/thread/xlp3od60fjl8nl44z4f56y0lhs7pglos

Fixes CVE-2006-20001, CVE-2022-36760, CVE-2022-37436:
https://httpd.apache.org/security/vulnerabilities_24.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 60d8585570)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:26:50 +01:00
Fabrice Fontaine
72c06e1764 package/xxhash: set XXH_NO_INLINE_HINTS
Set XXH_NO_INLINE_HINTS to marks all internal functions as static,
giving the compiler full control on whether to inline or not. This will
fix the following build failure raised since bump to version 0.8.1 in
commit 5dbdb2535c:

In file included from xxhash.c:43:
In function 'XXH3_accumulate',
    inlined from 'XXH3_hashLong_internal_loop' at xxhash.h:4390:9,
    inlined from 'XXH3_hashLong_64b_internal' at xxhash.h:4453:5,
    inlined from 'XXH3_hashLong_64b_withSecret' at xxhash.h:4473:12,
    inlined from 'XXH3_64bits_internal' at xxhash.h:4554:12,
    inlined from 'XXH3_64bits_withSecret' at xxhash.h:4570:12:
xxhash.h:4196:1: error: inlining failed in call to 'always_inline' 'XXH3_accumulate_512_scalar': function not considered for inlining
 4196 | XXH3_accumulate_512_scalar(void* XXH_RESTRICT acc,
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/f2c52238df97cc4c13117d8dc1423235231a094c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 94b66fb49c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:02:50 +01:00
Peter Korsgaard
ae835e094f Update for 2022.02.9
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-18 11:44:24 +01:00
Casey Reeves
e18846284c fs/erofs: enable support for reproducible build
By default, mkfs.erofs will use the current date to set some metadata
in the filesystem it generates, and will also use generate a random UUID
for that filesystem. This is not reproducible.

When BR2_REPRODUCIBLE is selected, set the filesystem timestamps to
$SOURCE_DATE_EPOCH, and the filesystem UUID to the nil uuid (as good
as any other arbitrary one).

Signed-off-by: Casey Reeves <casey@xogium.me>
[yann.morin.1998@free.fr:
  - one multi-line assignment, not two
  - slightly rephrase the commit log
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ac5ecaf868)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-17 10:26:11 +01:00
Peter Korsgaard
a6a0b2c08f package/go: explicitly set GOMODCACHE
go mod vendor caches downloaded modules to the Go module cache, which
defaults to $GOPATH/pkg/mod - But can be overridden with the GOMODCACHE
environment variable:

https://go.dev/ref/mod#module-cache

So explicitly set GOMODCACHE= for reproducibility.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 162f656884)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-17 10:24:36 +01:00
Peter Korsgaard
b007397e80 package/go: set GOCACHE for download post-process
The go mod vendor call in support/download/go-post-process accesses the go
cache, so pass GOCACHE= in the environment to ensure our cache directory is
used.

The go cache defaults to ~/.cache/go-build if not set, so this fixes builds
where that location (or GOCACHE if set in the environment) is not writable:

rm -rf ~/.cache/go-build
chmod -w ~/.cache
make docker-compose-source
..
failed to initialize build cache at /home/peko/.cache/go-build: mkdir /home/peko/.cache/go-build: permission denied
make[1]: *** [package/pkg-generic.mk:189: /home/peko/source/buildroot/output/build/docker-compose-2.14.0/.stamp_downloaded] Error 1

We use two different cache directories for target and host builds, but the
download/vendoring should be independent of the architecture, so use the
target variant even for host-only packages for simplicity.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 07a745e55d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-17 10:24:35 +01:00
Lang Daniel
12dbc6c825 package/at-spi2-core: switch to https download
Signed-off-by: Daniel Lang <d.lang@abatec.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit dde078790a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:52:41 +01:00
Nicolas Carrier
87d8b2e07b package/lpeg: add missing LPEG_LICENSE_FILES
The lpeg.html file declares the licensing terms at its bottom, so it
should work as a license file.

Signed-off-by: Nicolas Carrier <nicolas.carrier@orolia.com>
[yann.morin.1998@free.fr: use LPEG_SUBDIR]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 52afc0b3b5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:42:11 +01:00
Nicolas Carrier
71bb1b27ea package/pkg-generic.mk: no legal info WARNING if REDISTRIBUTE = NO
Packages making use of OVERRIDE_SRC_DIR or of the local SITE_METHOD,
will trigger a warning when the legal-info target is built, for example:

WARNING: foo: sources not saved (local packages not handled)

But in the situation where the packages has explicitly defined
FOO_REDISTRIBUTE = NO
in its .mk file, it makes no sense since the sources wouldn't be saved
anyway.

This patch swap the conditions on the type of package and on the
REDISTRIBUTE value, so that the warnings get issued only if
REDISTRIBUTE equals YES.

Signed-off-by: Nicolas Carrier <nicolas.carrier@orolia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c541df4180)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:42:02 +01:00
Fabrice Fontaine
5b8918a99e package/janus-gateway: add libcurl optional dependency
libcurl is an optional dependency which is enabled by default since at
least version 0.0.9 and
ca9c0a86f9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 60cf07079b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:40:17 +01:00
Bernd Kuhls
2a77cd4858 package/tor: security bump version to 0.4.7.13
Changelog:
https://gitlab.torproject.org/tpo/core/tor/-/blob/main/ChangeLog?expanded=true&viewer=simple

Fixes CVE-2023-23589 aka TROVE-2022-002:
https://gitlab.torproject.org/tpo/core/tor/-/issues/40730

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit beeb4a2aad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:31:15 +01:00
Bernd Kuhls
a3f5889695 package/tor: bump version to 0.4.7.12
Changelog:
https://gitlab.torproject.org/tpo/core/tor/-/blob/main/ChangeLog?expanded=true&viewer=simple

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8b8c1f832b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:31:07 +01:00
Bernd Kuhls
e8d86b9a95 package/tor: bump version to 0.4.7.10
Release notes:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit db15505180)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:30:52 +01:00
Christian Stewart
153a6ae28f package/docker-cli: bump version to 20.10.22
https://github.com/moby/moby/releases/tag/v20.10.22

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8e6fcd46fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:28:13 +01:00
Christian Stewart
400edb09a8 package/docker-engine: bump version to 20.10.22
Bug fixes and enhancements

 - Improve error message when attempting to pull an unsupported image format or OCI artifact (moby/moby#44413, moby/moby#44569)
 - Fix an issue where the host's ephemeral port-range was ignored when selecting random ports for containers (moby/moby#44476).
 - Fix ssh: parse error in message type 27 errors during docker build on hosts using OpenSSH 8.9 or above (moby/moby#3862).
 - seccomp: block socket calls to AF_VSOCK in default profile (moby/moby#44564).

https://github.com/moby/moby/releases/tag/v20.10.22

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit de51efc543)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:28:11 +01:00
Peter Korsgaard
e1be0eb4be {linux, linux-headers}: bump 4.9.x / 5.{10, 15}.x / 6.{0, 1}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 479b042433)
[Peter: drop 6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:25:54 +01:00
Fabrice Fontaine
82a504e9fe package/libpjsip: security bump to version 2.13
- Fix CVE-2022-39269, CVE-2022-39244 and CVE-2022-31031:
  https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg
  https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
  https://github.com/pjsip/pjproject/security/advisories/GHSA-26j7-ww69-c4qj
- Drop patch (already in version)
- libuuid configure option is available since
  0b0488f17b
- libupnp is an optional dependency since
  82247cb8c0
- libsrtp is optional since
  fe6cbbc397

https://github.com/pjsip/pjproject/releases/tag/2.13

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cbc80c7557)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:16:34 +01:00
Lang Daniel
d37575c229 DEVELOPERS: add Daniel Lang for package/libsigc
Signed-off-by: Daniel Lang <d.lang@abatec.at>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 189543e4ab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:13:19 +01:00
Bartosz Golaszewski
517a6a4115 DEVELOPERS: remove Bartosz Golaszewski
It's been a while since I've even used buildroot at all and I don't
really have any spare cycles to spend on maintaining its packages.
Let's face reality and drop me from the DEVELOPERS file.

Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 24c532c9f6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:03:21 +01:00
Nevo Hed
ba59c92c9d Makefile: fix use of many br2-external trees
The top level Makefile in buildroot has a recursive rule which causes
the appearance of a hang as the number of directories in BR2_EXTERNAL
increases. When the number of directories in BR2_EXTERNAL is small, the
recursion occurs, but make detects the recursion and determines the
target does not have to be remade. This allows make to progress.

This is the failing rule:

    define percent_defconfig
    # Override the BR2_DEFCONFIG from COMMON_CONFIG_ENV with the new defconfig
    %_defconfig: $(BUILD_DIR)/buildroot-config/conf $(1)/configs/%_defconfig outputmakefile
        @$$(COMMON_CONFIG_ENV) BR2_DEFCONFIG=$(1)/configs/$$@ \
                $$< --defconfig=$(1)/configs/$$@ $$(CONFIG_CONFIG_IN)
    endef
    $(eval $(foreach d,$(call reverse,$(TOPDIR) $(BR2_EXTERNAL_DIRS)),$(call percent_defconfig,$(d))$(sep)))

The rule for %defconfig is created for each directory in BR2_EXTERNAL.
When the rule is matched, the stem is 'defconfig_name'. The second
prerequisite is expanded to $(1)/configs/defconfig_name_defconfig. The
rule, and all of the other rules defined by this macro, are invoked
again, but the stem is now $(1)/configs/defconfig_name_defconfig. The
second prerequisite is now expanded to
$(1)/configs/($1)/configs/defconfig_name_defconfig. This expansion
continues until make detects the infinite recursion.

With up to 5 br2-external trees, the time is very small, so that it is
not noticeable. But starting with 6 br2-external trees, the time is
insanely big (so much so that we did not even let it finish after it ran
for hours); see timings toward the end of the commit log.

We fix that by adding a single %_defconfig rule, which is now rsponsible
to find the actual defconfig file that triggered the rule, by iterating
on the reverse list of br2-external trees and then in main tree.

Of course, now, there is no way for make to warn that there is no such
defconfig, as it is no longer part of the prerequisites of the rule. So,
we delegate to the recipe the responsibility to check for that.

Timing (seconds) of `make pc_x86_64_bios_defconfig` with 1..1000
external trees, with make 4.2.1 (* with make 4.3), on a Core i7-7700HQ:

    #trees    Before    After
         1     0.312    0.319
         2     0.319    0.323
         3     0.325    0.327
         4     0.353    0.339
         5     0.993    0.349
         6     1.26*    0.347
         7     9.10*    0.362
         8    85.93*    0.360
         9     n/a      0.373
        10     n/a      0.374
        50     n/a      0.738
       100     n/a      1.228
       500     n/a      7.483
      1000     n/a     16.076

How to reproduce:

    #!/usr/bin/env bash

    N="${1:-1000}"

    for i in $(seq 1 1000); do
        [ -d "br2-external/${i}/configs" ] && break
        mkdir -p br2-external/${i}/configs
        touch br2-external/${i}/{Config.in,external.mk}
        echo "name: BR_TEST_${i}" >br2-external/${i}/external.desc
        touch br2-external/${i}/configs/foo{,_${i}}_defconfig
    done

    time make \
        BR2_EXTERNAL="$(
            for i in $(seq 1 ${N}); do
                printf '%s\n' "$(pwd)/br2-external/${i}"
            done
        )" \
        foo_1_defconfig

Notes: the timings are very dependent on how much the CPU is otherwise
loaded, but having a multi-core CPU slightly loaded helps maintain a
high frequency on the siblings, and that can reduce the above timings
in half! Best to try on an otherwise-idle system.

Fixes: #14996

Reported-by: David Lawson <david.lawson1@tx.rr.com>
Signed-off-by: Nevo Hed <nhed+buildroot@starry.com>
[yann.morin.1998@free.fr:
  - split long foreach
  - drastically extend the commit log
  - provide reproducer script and redo timings
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e6195c5304)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-12 11:20:09 +01:00