Commit Graph

54578 Commits

Author SHA1 Message Date
Fabrice Fontaine
6218b0de22 package/libupnp18: drop package
Drop libupnp18 as libupnp has been bumped to 1.14.x and 1.8.x will not
been fixed against CallStranger a.k.a. CVE-2020-12695

mpd and vlc are already compliant with libupnp 1.14.x (i.e those
packages use UpnpInit2 instead of the deprecated UpnpInit)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eddc9df972)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 20:24:04 +01:00
Fabrice Fontaine
389d1524b4 package/ushare: add libupnp 1.14.x support
This switch is needed to fix CallStranger a.k.a. CVE-2020-12695

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f851b36371)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:56:03 +01:00
Fabrice Fontaine
fae5c287ca package/gmrender-resurrect: add libupnp 1.14.x support
Using libupnp 1.14.x is needed to fix CallStranger a.k.a. CVE-2020-12695

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9f3f2fa6a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:55:31 +01:00
Fabrice Fontaine
caf4d9ffae package/igd2-for-linux: security bump to version 2.0
- Move site to Orange-OpenSource
- Drop patch (already in version)
- This version is compatible with libupnp 1.14.x to fix
  CallStranger a.k.a. CVE-2020-12695
- Add threadutil license (BSD-3-Clause)
- Update hash in license file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a83073ac31)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:53:02 +01:00
Fabrice Fontaine
e9dd318ac3 package/gerbera: security bump to version 1.6.4
- This version is compatible with libupnp 1.14.x which fix
  CallStranger a.k.a. CVE-2020-12695
- Drop all patches (already in version)
- expat is not needed since version 1.5.0 and
  a4f0cccd6a
- fmt is a mandatory dependency since version 1.5.0 and
  fe81e5fc88
- spdlog is a mandatory dependency since version 1.5.0 and
  615d698fe4
- pugixml is a mandatory dependency since version 1.5.0 and
  c244006aa0
- libnpupnp can be used instead of libupnp since version 1.6.2 and
  e648763626
- Set CXX_FILESYSTEM_NO_LINK_NEEDED to ON to avoid a build failure
  due to check_cxx_source_runs which has been added with
  8ea0fce24c
- Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr:
  - libupnp and libnpupnp are mutually exclusive
  - fix typo in npupnp package name
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 61b1107e30)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:52:25 +01:00
Fabrice Fontaine
e96410be8d package/libupnp: security bump to version 1.14.0
- Fix CallStranger a.k.a. CVE-2020-12695 as well as CVE-2020-13848
- Update indentation in hash file (two spaces)
- Backport all changes from libupnp18 to libupnp:
  - Use COPYING instead of LICENSE (no license change)
  - Add host-pkgconf dependency
  - Add --enable-reuseaddr
  - Add openssl optional dependency

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 118648d161)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:51:30 +01:00
Fabrice Fontaine
9fd1c3b480 package/mpd: create directories used in mpd.conf
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=13471

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d0031c5621)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:39:38 +01:00
Fabrice Fontaine
3b72c7f8d9 package/openldap: security bump to version 2.4.57
Fixes the following security issues:

- CVE-2020-36221: An integer underflow was discovered in OpenLDAP before
  2.4.57 leading to slapd crashes in the Certificate Exact Assertion
  processing, resulting in denial of service (schema_init.c
  serialNumberAndIssuerCheck).

- CVE-2020-36222: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  an assertion failure in slapd in the saslAuthzTo validation, resulting in
  denial of service.

- CVE-2020-36223: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  a slapd crash in the Values Return Filter control handling, resulting in
  denial of service (double free and out-of-bounds read).

- CVE-2020-36224: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  an invalid pointer free and slapd crash in the saslAuthzTo processing,
  resulting in denial of service.

- CVE-2020-36225: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  a double free and slapd crash in the saslAuthzTo processing, resulting in
  denial of service.

- CVE-2020-36226: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  a memch->bv_len miscalculation and slapd crash in the saslAuthzTo
  processing, resulting in denial of service.

- CVE-2020-36227: A flaw was discovered in OpenLDAP before 2.4.57 leading to
  an infinite loop in slapd with the cancel_extop Cancel operation,
  resulting in denial of service.

- CVE-2020-36228: An integer underflow was discovered in OpenLDAP before
  2.4.57 leading to a slapd crash in the Certificate List Exact Assertion
  processing, resulting in denial of service.

- CVE-2020-36229: A flaw was discovered in ldap_X509dn2bv in OpenLDAP before
  2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring,
  resulting in denial of service.

- CVE-2020-36230: A flaw was discovered in OpenLDAP before 2.4.57 leading in
  an assertion failure in slapd in the X.509 DN parsing in decode.c
  ber_next_element, resulting in denial of service.

https://www.openldap.org/software/release/changes.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 46c4c9684d)
[Peter: mark as security bump, add CVE info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:34:13 +01:00
Kalpesh Panchal
a1d3dd8421 package/uboot-tools: resolve uboot env source file error
If Target u-boot is not available, the host build of uboot-tools
requires user to provide u-boot environment source file.
This change resolves a missing parentheses and updates the comment
for the same.

Signed-off-by: Kalpesh Panchal <kalpesh.panchal@rockwellcollins.com>
Signed-off-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4419c3dafd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 19:29:21 +01:00
Maxim Kochetkov
89a47457a8 package/postgresql: add some additional output to pg_config
Some external packages call pg_config to determine the installed
PostgreSQL options. Add this output to Buildroots own pg_config,
so these packages correctly compile.

Added options:
	--pkgincludedir
	--pgxs
	--cflags
	--cc
	--pkglibdir
	--bindir
	--sharedir
	--localedir
	--docdir
	--mandir

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e3ff618bd8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:35:03 +01:00
Titouan Christophe
bffdab0612 package/redis: bump to v6.0.10
Redis 6.0.10 fixes several bugs with moderate impact.

Read the full announcement:
https://github.com/redis/redis/blob/6.0.10/00-RELEASENOTES

Signed-off-by: Titouan Christophe <titouanchristophe@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7ee49e48bd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:23:43 +01:00
Bernd Kuhls
a5fe4ec31f {linux, linux-headers}: bump 5.{4, 10}.x 4.{4, 9, 14, 19} series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6943c84d9c)
[Peter: drop 5.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:08:53 +01:00
Fabrice Fontaine
761a7334c1 package/libtorrent-rasterbar: drop host gcc dependency
Drop host gcc dependency which has wrongly been added by commit
0393f5d344

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ab0af07ce2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:05:36 +01:00
Fabrice Fontaine
c0162e6c7a package/brltty: add polkit optional dependency
polkit is an optional dependency (enabled by default) since version 5.4:
e62b3c925d

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 74c6a7e4db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:02:03 +01:00
Gwenhael Goavec-Merou
19aa4e9ee7 package/uhd: fix build on RISC-V
When the target CPU is riscV, msgpack is unable to detect endianness with a list of errors like:

uhd/host/lib/deps/rpclib/include/rpc/msgpack/pack.hpp:190:2: error: #error msgpack-c supports only big endian and little endian
  190 | #error msgpack-c supports only big endian and little endian
      |  ^~~~~

and with subsequent errors:

uhd0/host/lib/deps/rpclib/include/rpc/msgpack/pack.hpp:236:46: error: there are no arguments to 'take8_8' that depend on a template parameter, so a declaration of 'take8_8' must be available [-fpermissive]
  236 |     char buf[2] = {static_cast<char>(0xccu), take8_8(d)};
      |

This is due to a missing support for this architecture in msgpack.
This patch adapt commit from https://github.com/boostorg/predef

[backported from https://github.com/EttusResearch/uhd/pull/400]

Fix:
- http://autobuild.buildroot.net/results/afacf5c5c2cd9dff6962523f1fdded9b474b9d66/
- http://autobuild.buildroot.net/results/91530538d630a7f09d85327e514f01b45253c1a6/
- http://autobuild.buildroot.net/results/91530538d630a7f09d85327e514f01b45253c1a6/
- and others

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8692d8f38d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 18:00:46 +01:00
Fabrice Fontaine
0c68c46440 package/sudo: fix static build without closefrom
Fixes:
 - http://autobuild.buildroot.org/results/515b45f876fa9de03c9235f86017f4dc10eb3b54

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b6eeb2fdda)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:54:52 +01:00
Thomas De Schampheleire
8253f57ad8 package/syslog-ng: fix build if net-snmp is installed on the host (again)
See also commit 4ff6e52392 which describes the
problem in detail.

The same problem now arises again, because syslog-ng renamed the
--enable-snmp-dest option into --enable-afsnmp. See syslog-ng commit
4537938474771673ef5bd4a9cad7c9a7dc20b7c1, first part of 3.27.1.

Update the configure options passed from Buildroot accordingly.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 40f4468e94)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:49:53 +01:00
Yann E. MORIN
a8f6453a55 utils: fix flake8 warning
Commit 40bb37bd70 refactored get-developers, and now the 'os' module is
no longer needed, but still imported:

    utils/get-developers:6:1: F401 'os' imported but unused
    1     F401 'os' imported but unused

Drop it now.

Reported-by: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9277978e28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:43:56 +01:00
Fabrice Fontaine
831a862f64 package/poppler: add boost optional dependency
boost is an optional dependency which is enabled by default since
version 0.80.0 and
355fd8d58c

There is no cmake option to enable or disable this dependency

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 497f989d75)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-28 17:28:20 +01:00
Bernd Kuhls
17c1e129e6 package/vlc: security bump version to 3.0.12
Removed patch which was applied upstream, removed md5 hash.

Security Bulletin: https://www.videolan.org/security/sb-vlc3012.html
Fixes CVE-2020-26664: https://nvd.nist.gov/vuln/detail/CVE-2020-26664

Added CPE_ID, cpe:2.3🅰️videolan:vlc_media_player is a valid CPE
identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&orderBy=2.3&keyword=cpe%3A2.3%3Aa%3Avideolan%3Avlc_media_player&status=FINAL

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit de128d9ad6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-22 09:39:25 +01:00
Yann E. MORIN
2a7f1d2571 package/pkg-meson.mk avoid host ccache detection
meson will by default try to detect the presence of ccache, and if
found, will use it unconditionally.

However, using a system-wide ccache, which would be using our own cache
directory, may very well conflict with our own ccache.

But there is no option to disable that meson behaviour. The only
workaround that is even the official documented way to do so, is to
actually pass environment variables that point to the compiler:

    https://mesonbuild.com/Feature-autodetection.html#ccache

For the host variants, we pass $(HOST_CONFIGURE_OPTS) in the environment,
and this contains correct settings for CC and CXX, so meson does not try
and detect ccache; it uses exactly what we tell it to use.

For the target variant, the settings for the cross-compiler are defined
in the cross-compilation file, and so meson just abides by our will. But
for the compiler-for-build, there is no way to specify the CC_FOR_BUILD
or CXX_FOR_BUILD via a cross-compilation file:

    https://mesonbuild.com/Machine-files.html
    https://mesonbuild.com/Cross-compilation.html

We could pass the full TARGET_CONFIGURE_OPTS in the environment, like we
do for the host variant, but this contains a lot more variables that are
supposed to be covered by the cross-compilation file.

So, we stay safe and just provide the exact two variables that meson
will use to avoid detecting ccache.

If the current configuration defines the use of ccache, then these two
variables will be properly setup to use our own ccache.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Gleb Mazovetskiy <glex.spb@gmail.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Norbert Lange <nolange79@gmail.com>
(cherry picked from commit f4a61d1ae2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-22 09:33:05 +01:00
Romain Naour
0b6fd85ecc package/gcc: fix gcc 8.4, 9.3 and 10.2 for sparcv8 (ss10)
As reported on IRC by sephthir, the qemu_sparc_ss10_defconfig doesn't
work as expected: the system generated when booted under Qemu produces
illegal instruction messages.

gcc 8.3, 9.2 are the latest working gcc version. git bisect between
gcc 8.3 and 8.4 allowed to identify the commit that introcuced the
regression.

Reverting this patch allowed to produce a working rootfs.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/786589934

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4d16e6f532)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-22 09:21:49 +01:00
Peter Seiderer
f95aebff5a docs/manual/pkg-cmake.txt: add _INSTALL_OPTS description
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 93daabcfbd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:55:56 +01:00
Peter Seiderer
a2250c879d docs/manual/pkg-cmake.txt: fix _INSTALL_STAGING_OPTS/_INSTALL_TARGET_OPTS description
Since commit dfcc18f84b cmake-package
_INSTALL_STAGING_OPTS/_INSTALL_TARGET_OPTS use 'install/fast'
instead of 'install', adjust documentation accordingly.

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0c80a0da9a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:55:50 +01:00
Peter Seiderer
ed81ce32e3 package/pkg-cmake.mk: fix indent
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 281f07b71b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:55:42 +01:00
Fabrice Fontaine
f8360ca334 package/sudo: security bump to version 1.9.5p1
- Fixes CVE-2021-23239, a potential information leak in sudoedit that
  could be used to test for the existence of directories not normally
  accessible to the user in certain circumstances. When creating a new
  file, sudoedit checks to make sure the parent directory of the new
  file exists before running the editor. However, a race condition
  exists if the invoking user can replace (or create) the parent
  directory. If a symbolic link is created in place of the parent
  directory, sudoedit will run the editor as long as the target of the
  link exists. If the target of the link does not exist, an error
  message will be displayed. The race condition can be used to test for
  the existence of an arbitrary directory. However, it cannot be used to
  write to an arbitrary location.
- Fixes CVE-2021-23240, a flaw in the temporary file handling of
  sudoedit's SELinux RBAC support. On systems where SELinux is enabled,
  a user with sudoedit permissions may be able to set the owner of an
  arbitrary file to the user-ID of the target user. On Linux kernels
  that support protected symlinks setting
  /proc/sys/fs/protected_symlinks to 1 will prevent the bug from being
  exploited. For more information, see Symbolic link attack in
  SELinux-enabled sudoedit.
- Update license hash:
  - copyright of python bindings added with
    6c1b155fed
  - a few other files (ISC licenced) added with
    d4b2db9078
  - year updated with
    9e111eae57
- Update indentation in hash file (two spaces)

https://www.sudo.ws/stable.html#1.9.5p1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1b14e99666)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:46:18 +01:00
Thomas Petazzoni
f7d4bc416c utils/getdeveloperlib.py: use relative paths for files
Using absolute paths within getdeveloperlib isn't very sensible, it
makes a lot more sense to handle everything as relative paths from the
top-level Buildroot source directory.

parse_developers() is changed to no longer take the base path as
argument: it is automatically calculated based on the location of
utils/getdeveloperlib.py. Then, the rest of the logic is adjusted to
use relative paths, and prepend them with the base "brpath" when
needed.

This commit allows pkg-stats to report correct developers information
even when executed from an out of tree directory.

Before this patch:

$ ~/buildroot/support/scripts/pkg-stats -p ipmitool --json out.json
$ cat out.json | jq '.packages.ipmitool.developers'
[]

$ cat out.json | jq '.defconfigs.stm32f469_disco'
{
  "name": "stm32f469_disco",
  "path": "configs/stm32f469_disco_defconfig",
  "developers": []
}

After this patch:

$ ~/buildroot/support/scripts/pkg-stats -p ipmitool --json out.json
$ cat out.json | jq '.packages.ipmitool.developers'
[
  "Floris Bos <bos@je-eigen-domein.nl>",
  "Heiko Thiery <heiko.thiery@gmail.com>"
]
$ cat out.json | jq '.defconfigs.stm32f469_disco'
{
  "name": "stm32f469_disco",
  "path": "configs/stm32f469_disco_defconfig",
  "developers": [
    "Christophe Priouzeau <christophe.priouzeau@st.com>"
  ]
}

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Tested-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 40bb37bd70)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:24:12 +01:00
Thomas Petazzoni
fdb7ee67d2 utils/get-developers: use Developers.hasfile() where appropriate
Instead of open-coding Developers.hasfile() in utils/get-developers,
use it directly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Tested-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 57ecb6c8eb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:24:06 +01:00
Thomas Petazzoni
9d160596de support/scripts/pkg-stats: fix Python 3.8 deprecation warning
With Python 3.8, the following deprecation warnings are emitted:

/home/thomas/projets/buildroot/./support/scripts/pkg-stats:418: DeprecationWarning: The explicit passing of coroutine objects to asyncio.wait() is deprecated since Python 3.8, and scheduled for removal in Python 3.11.

/home/thomas/projets/buildroot/./support/scripts/pkg-stats:536: DeprecationWarning: The explicit passing of coroutine objects to asyncio.wait() is deprecated since Python 3.8, and scheduled for removal in Python 3.11.

The correct way to pass coroutines is to use asyncio.create_task(),
but this is rather new method (Python 3.7), and using it breaks
compatibility with older Python versions. As suggested at
https://docs.python.org/3/library/asyncio-task.html#asyncio.create_task,
use the more cryptic, but also more compatible asyncio.ensure_future()
method.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ffb2620405)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:23:56 +01:00
Thomas Petazzoni
ee4e2f1611 support/scripts/pkg-stats: import cve module only when needed
The cve module needs ijson, which may not be installed. Since cve
matching is only enabled when --nvd-path is passed, it is a bit silly
to error out about ijson being missing if it's not used.

So instead of unconditionally importing the cve module, only do it
conditionally.

However, instead of doing it right at the point where it is used, we
do it at the beginning of the main() function. Indeed, if the cve
module is needed but cannot be imported, we want to error out
immediately rather than doing a whole bunch of things, and failing on
the user later on in the middle of the pkg-stats execution.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Tested-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 824032d168)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:23:47 +01:00
Bernd Kuhls
6fc8ee105f package/resiprocate: resiprocate-apps need openssl
Fixes:
http://autobuild.buildroot.net/results/7ac/7ac82a3ac4b06cb5ad44e92548d66a0f79d149a6/

In file included from Server.cxx:19:
../../resip/stack/ssl/Security.hxx:32:10: fatal error: openssl/ssl.h: No such file or directory

clicktoall needs openssl:
https://github.com/resiprocate/resiprocate/blob/resiprocate-1.12/apps/clicktocall/Makefile.am#L16

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2cc6bd7482)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:18:03 +01:00
Thomas Petazzoni
4ed3a10184 support/config-fragments/autobuild/bootlin-x86-64-glibc: use toolchain-external-bootlin
Until now the bootlin-x86-64-glibc was using a Bootlin toolchain as a
custom external toolchain. However, now that we have the
toolchain-external-bootlin package explicitly supporting Bootlin
toolchains as known toolchain profiles, it makes sense to use
that. Indeed, this will ensure that this autobuilder configuration
will use the latest available version of the Buildroot toolchain for
x86-64 glibc.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 01533244a5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 15:09:32 +01:00
Giulio Benetti
1b886e4fe6 package/sunxi-mali-mainline-driver: fix build failure with Linux 5.9 and 5.10
Add 2 patches pending[1] upstream to fix build failure with both Linux 5.9
and Linux 5.10 due to uaccess.h file moved after version >= 5.9 and and
due to moved code from dma-contiguous.h to dma-mapping.

[1]: https://github.com/mripard/sunxi-mali/pull/89

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6bb9cffebc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-19 14:20:33 +01:00
Bernd Kuhls
99e4d80815 package/kodi-pvr-zattoo: fix json dependency
Package depends on rapidjson, not rapidxml:
https://github.com/rbuehlma/pvr.zattoo/blob/Leia/CMakeLists.txt#L10

The bug was previously not noticed because kodi depends on rapidjson
https://github.com/xbmc/xbmc/blob/Leia/CMakeLists.txt#L133
and kodi-platform depends on kodi
https://github.com/xbmc/kodi-platform/blob/master/CMakeLists.txt#L8

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e1ecd5b582)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-18 22:25:32 +01:00
Bernd Kuhls
b27a7c92d8 package/xorriso: bump version to 1.5.2
Release notes:
https://lists.gnu.org/archive/html/bug-xorriso/2019-10/msg00005.html

Reformatted hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ce94a8b7ce)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-18 22:17:33 +01:00
Thomas Petazzoni
c043b783e1 toolchain/toolchain-external/toolchain-external-bootlin: update PowerPC 440 FP toolchain
The Bootlin PowerPC 440 FP toolchain was rebuilt in version 2020.08-2,
which is rebased on Buildroot 2020.08.3 as that includes a fix for
SecurePLT support.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e8a6ca6821)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-18 22:12:27 +01:00
Fabio Estevam
489736cd02 package/freescale-imx/firmware-imx: fix the VPU firmware location
The mainline kernel searches the coda VPU firmware inside the following
locations [1]:

/lib/firmware/
/lib/firmware/vpu/

Currently Buildroot installs the coda firmware into /lib/firmware/imx/vpu,
which is not a valid location.

Fix it by installing the coda firmwares into /lib/firmware/vpu/ which
is a valid path for both mainline and NXP vendor kernels. Also create a
symlink to /lib/firmware/ so that mainline kernels do not need to wait
more than 60 seconds to search again inside /lib/firmware/vpu/.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8af7779f3cbc1f6720d15f00abc797493710d1ab

Reported-by: Romain Naour <romain.naour@gmail.com>
Suggested-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Acked-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ec18cac9f9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-18 21:36:11 +01:00
Fabrice Fontaine
77ed637912 package/wolfssl: security bump to version 4.6.0
- Fix CVE-2020-36177: RsaPad_PSS in wolfcrypt/src/rsa.c in wolfSSL
  before 4.6.0 has an out-of-bounds write for certain relationships
  between key size and digest size.
- Drop patch (already in version)

https://github.com/wolfSSL/wolfssl/releases/tag/v4.6.0-stable

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6a2d5ab0ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-18 21:18:37 +01:00
Yann E. MORIN
4bab3f33e0 pkg-generic: host variant use git submodules if target variant does
When a package has both a target and a host variant, and uses git
submodules, and the host variant is downloaded before the target one, we
end up with the generated archive missing the submodules.

This happens in exactly one package in our tree: c-capnproto.

This issue was not caught before because after a few days, the full
sources are added to sources.buildroot.net. So when the hash check
fails, the full tarball is simply downloaded from there.

Propagate the git submodule setting from the target variant to the host
variant, unless the host variant explicitly opted-out.

Fixes:
    http://autobuild.buildroot.org/results/2de9c6c8ce83569d18cc7140ebc60d6fe1aadcbf/

Reported-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4d03923b6a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-18 21:08:46 +01:00
Fabrice Fontaine
616e3a2cb1 package/wavpack: security bump to version 5.4.0
WavPack 5.4.0 contains a fix for CVE-2020-35738 wherein a specially
crafted WAV file could cause the WAVPACK command-line program to crash
with an out-of-bounds write (see issue #91).

Update hash of COPYING (update in year:
2ce3c069be)

https://github.com/dbry/WavPack/blob/5.4.0/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c7390708f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-17 17:52:16 +01:00
Petr Vorel
74ce89cc21 {linux, linux-headers}: bump 5.{4, 10}.x 4.{4, 9, 14, 19} series
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ef94e70295)
[Peter: drop 5.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-17 17:46:04 +01:00
Peter Korsgaard
151f5b2cb7 package/wireguard-linux-compat: bump version to 1.0.20201221
Fixes a build issue with linux-rt >= 5.4.  For details, see the
announcement:
https://lists.zx2c4.com/pipermail/wireguard/2020-December/006210.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5fa51794c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-13 08:11:25 +01:00
Petr Vorel
478b6ae274 {linux, linux-headers}: bump 5.{4, 10}.x 4.{4, 9, 14, 19} series
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
[Peter: add Config.in.legacy handling for 5.9]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 54584d233b)
[Peter: drop 5.10.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 22:06:34 +01:00
Bernd Kuhls
52bee93025 toolchain: CodeSourcery AArch64 2014.11 does not contain libatomic
Fixes build error

output/host/opt/ext-toolchain/bin/../lib/gcc/aarch64-amd-linux-gnu/4.9.1/../../../../aarch64-amd-linux-gnu/bin/ld:
 cannot find -latomic

using this defconfig

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CODESOURCERY_AARCH64=y
BR2_PACKAGE_OPENSSL=y

libopenssl is only used here as an example: all packages adding -latomic
if BR2_TOOLCHAIN_HAS_LIBATOMIC=y are broken, like dav1d, ffmpeg, gnutls,
kodi and vlc.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a530fd4a42)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 21:33:23 +01:00
Yann E. MORIN
72cc541c66 package/libclc: switch to use the frozen, legacy mirror
The LLVM project has switched to using a monorepo to host all their
components. The separate, individual repositories have been closed
late 2020 / early 2021. The libclc repository is no longer.

Switch to using the libclc source from the llvm legacy and frozen
mirror.

Even though we could switch over to using the github helper, we just
keep using the git download method: it is a small repository, and it
will not impact people that were already using it.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Romain Naour <romain.naour@gmail.com>
Cc: Valentin Korenblit <valentinkorenblit@gmail.com>
Cc: Michael Opdenacker <michael.opdenacker@bootlin.com>
Acked-by: Romain Naour <romain.naour@gmail.com>
(cherry picked from commit 971d1ea7ac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 18:42:14 +01:00
Yann E. MORIN
de750659bc package/tzdata: drop obosolete, legacy zic option -y
The following commits:
  - 7868289fd5 package/zic: bump version to 2020f
  - c99374ecbb package/tzdata: bump version to 2020f

bumped the tzdata from version 2020a to 2020f. However, in 2020b, the
zic option '-y' was removed, and so was the yearistype.sh script [0].

This now spews annoying warnings:

    warning: -y ignored

Fortunately, it still consumes its argument, so the missing yearistype.sh
is simply ignored.

Drop that option.

[0] https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
(cherry picked from commit 7f78eef767)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 18:26:20 +01:00
Bernd Kuhls
aacc6164cf package/tzdata: bump version to 2020f
Release notes:
https://mm.icann.org/pipermail/tz-announce/2020-December/000064.html

Upstream removed timezones pacificnew and systemv:
https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c99374ecbb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 18:25:57 +01:00
Bernd Kuhls
4385e81332 package/zic: bump version to 2020f
Release notes:
https://mm.icann.org/pipermail/tz-announce/2020-December/000064.html

Rebased patch.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7868289fd5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 18:25:27 +01:00
Fabrice Fontaine
8365bbdf3f package/multipath-tools: fix license
As stated in README.md, multipath-tools is covered by several licenses
and LGPL-2.0 is "just" the default license:
 - GPL-2.0+ (e.g. libmultipath/alias.c)
 - GPL-3.0+ (e.g. libdmmp/libdmmp.c)
 - LGPL-2.1+ (e.g. libmpathcmd/mpath_cmd.c)

So replace COPYING (which is a symlink to LICENSES/LGPL-2.0) by the
approriate license files in LICENSES directory

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: further split long lines]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fc7b7f73c4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 18:21:50 +01:00
Fabrice Fontaine
f725ba28ee package/multipath-tools: disable -Werror
Set the new WARNFLAGS to "" which has been added since version 0.8.5 and
82f1b164cb

Otherwise, -Werror will raise the following build failure:

/srv/storage/autobuild/run/instance-3/output-1/host/bin/mipsel-linux-gcc --std=gnu99 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -O2  -D_FORTIFY_SOURCE=1  -Werror -Wall -Wextra -Wformat=2 -Werror=implicit-int -Werror=implicit-function-declaration -Werror=format-security -Wno-clobbered -Wno-error=clobbered -Werror=cast-qual -Werror=discarded-qualifiers -pipe -DBIN_DIR=\"/sbin\" -DLIB_STRING=\"lib\" -DRUN_DIR=\"run\" -MMD -MP -fPIC -I.. -I../../libmultipath/nvme -Wp,-D_FORTIFY_SOURCE=2  -c -o nvme.o nvme.c
<command-line>: error: "_FORTIFY_SOURCE" redefined [-Werror]

Fixes:
 - http://autobuild.buildroot.org/results/71f7661e7d26ca8608e902eee9f2a92376b00601

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fe4b4e9dc3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-01-12 18:21:44 +01:00