Commit Graph

57 Commits

Author SHA1 Message Date
Adrian Perez de Castro
b2c5bf66ac package/wpewebkit: security bump to version 2.34.4
This is a minor release which provides fixes for CVE-2021-30934,
CVE-2021-30936, CVE-2021-30951, CVE-2021-30952, CVE-2021-30953,
CVE-2021-30954, CVE-2021-30984, and the safarileaks.com vulnerability
(which has not yet been assigned a CVE number). Release notes can be
found at:

  https://wpewebkit.org/release/wpewebkit-2.34.4.html

An accompanying security advisory has been published at:

  https://wpewebkit.org/security/WSA-2022-0001.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2022-01-26 22:44:44 +01:00
Adrian Perez de Castro
b9d7644c53 package/wpewebkit: security bump to version 2.34.3
This is a minor release which provides fixes for CVE-2021-30887
and CVE-2021-30890. Full release notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.34.3.html

An accompanying security advisory has been published at:

  https://wpewebkit.org/security/WSA-2021-0007.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-12-23 18:37:58 +01:00
James Hilliard
c4b36ba4b6 package/wpewebkit: select videorate when building with media-stream support
Fixes:
ERROR GST_PIPELINE gst/parse/grammar.y:857:priv_gst_parse_yyparse: no element "videorate"

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-12-17 23:04:51 +01:00
Adrian Perez de Castro
4b89414ca8 package/wpewebkit: bump version to 2.34.2
Update to the the next minor release, which fixes an scrolling issue and
incorporated a patch that can now be removed from Buildroot. Release
notes:

  https://wpewebkit.org/release/wpewebkit-2.34.2.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Tested-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-12-11 21:46:17 +01:00
Adrian Perez de Castro
84e90ce45c package/wpewebkit: use lcms2 for if available
Make wpewebkit support color management if the lcms2 package
has been selected.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-11-17 22:00:48 +01:00
Adrian Perez de Castro
86f46249b3 package/wpewebkit: bump to version 2.34.1
Update to a new major release which brings in improvements and a number
of new features. Release notes:

  https://wpewebkit.org/release/wpewebkit-2.34.0.html
  https://wpewebkit.org/release/wpewebkit-2.34.1.html

Some of the new features require additional dependencies: HTTP/2
requires libsoup3, which is not yet in packaged in Buildroot, and
disabled at the moment (with -DUSE_SOUP2=ON, to keep using libsoup2);
and the color management support needs LCMS2 (which will be enabled
in a follow-up patch.)

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-11-17 21:59:34 +01:00
Fabrice Fontaine
3c83c1fd4a package/ruby: needs gcc and host gcc >= 4.9
ruby needs gcc and host gcc >= 4.9 since commit
5f1c6758a5 and the addition of AC_PROG_CC:

In file included from vm_core.h:85:0,
                 from iseq.h:14,
                 from mini_builtin.c:3,
                 from miniinit.c:51:
thread_pthread.h:108:43: error: expected '=', ',', ';', 'asm' or '__attribute__' before 'struct'
     RUBY_EXTERN RB_THREAD_LOCAL_SPECIFIER struct rb_execution_context_struct *ruby_current_ec;
                                           ^

Fixes:
 - http://autobuild.buildroot.org/results/f196f8bc68d1b4c20bddced89478598a3fcd3dea
 - http://autobuild.buildroot.org/results/81bdac585600877d3fa8d9478b7f160dbd1537a9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-11-05 17:08:22 +01:00
Adam Duskett
e11b068d6a package/wpewebkit: depend on host-python3
wpewebkit builds without issue using host-python3.

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Acked-By: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-10-14 23:33:14 +02:00
James Hilliard
7749e73b9a package/wpewebkit: add option to enable media-stream
This has a compile time dependency on gst1-plugins-bad due to
the codecparsers dependency.

We need to prevent the wpe plugin from being selected when wpewebkit
media-stream support is enabled as the wpe plugin requires wpewebkit
which would create a circular dependency with gst1-plugins-bad.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-10-06 21:11:10 +02:00
James Hilliard
56933c402e package/wpewebkit: remove gst1-plugins-good from dependencies
This is only a runtime dependency not a build dependency.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Adrian perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-10-03 22:13:57 +02:00
Adrian Perez de Castro
5d062fdbe8 package/wpewebkit: security bump to version 2.32.4
This is a minor release which provides fixes for CVE-2021-30858 and
a number of other potential security issues without an associated CVE.
Patch "0001-Add-ldp-and-stp-support-for-FP-registers-plus-some-b.patch"
is deleted as it has been included in this release.

Full release notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.32.4.html

An accompanying security advisory has been published at:

  https://wpewebkit.org/security/WSA-2021-0005.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2021-09-22 21:18:24 +02:00
Adrian Perez de Castro
5d46f5b29d package/wpewebkit: security bump to version 2.32.3
This is a minor release which provides fixes for CVE-2021-21775,
CVE-2021-21779, CVE-2021-30663, CVE-2021-30665, CVE-2021-30689,
CVE-2021-30720, CVE-2021-30734, CVE-2021-30744, CVE-2021-30749,
CVE-2021-30795, CVE-2021-30797, and CVE-2021-30799.

Full release notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.32.3.html

An accompanying security advisory has been published at:

  https://wpewebkit.org/security/WSA-2021-0004.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-25 14:58:14 +02:00
James Hilliard
8e436b6bfd package/wpewebkit: fix aarch64 renderer process crash
We need to backport an aarch64 patch to prevent a crash.

Fixes:
==654== Conditional jump or move depends on uninitialised value(s)
==654==    at 0x68CF9D0: contains (Range.h:115)
==654==    by 0x68CF9D0: mark (JITStubRoutineSet.h:57)
==654==    by 0x68CF9D0: mark (ConservativeRoots.cpp:127)
==654==    by 0x68CF9D0: genericAddPointer<JSC::CompositeMarkHook> (ConservativeRoots.cpp:69)
==654==    by 0x68CF9D0: genericAddSpan<JSC::CompositeMarkHook> (ConservativeRoots.cpp:101)
==654==    by 0x68CF9D0: JSC::ConservativeRoots::add(void*, void*, JSC::JITStubRoutineSet&, JSC::CodeBlockSet&) (ConservativeRoots.cpp:147)
==654==    by 0x68EA5BB: JSC::MachineThreads::gatherConservativeRoots(JSC::ConservativeRoots&, JSC::JITStubRoutineSet&, JSC::CodeBlockSet&, JSC::CurrentThreadState*, WTF::Thread*) (MachineStackMarker.cpp:202)
==654==    by 0x68D885B: _ZZN3JSC4Heap18addCoreConstraintsEvENUlRT_E0_clINS_11SlotVisitorEEEDaS2_ (Heap.cpp:2740)
==654==    by 0x68EFF7B: JSC::MarkingConstraint::execute(JSC::SlotVisitor&) (MarkingConstraint.cpp:58)
==654==    by 0x68F3D83: JSC::MarkingConstraintSolver::runExecutionThread(JSC::SlotVisitor&, JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>) (MarkingConstraintSolver.cpp:237)
==654==    by 0x68D4413: JSC::Heap::runTaskInParallel(WTF::RefPtr<WTF::SharedTask<void (JSC::SlotVisitor&)>, WTF::RawPtrTraits<WTF::SharedTask<void (JSC::SlotVisitor&)> >, WTF::DefaultRefDerefTraits<WTF::SharedTask<void (JSC::SlotVisitor&)> > >) (Heap.cpp:3061)
==654==    by 0x68F3E9F: runFunctionInParallel<JSC::MarkingConstraintSolver::execute(JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int>()>)::<lambda(JSC::SlotVisitor&)> > (Heap.h:397)
==654==    by 0x68F3E9F: JSC::MarkingConstraintSolver::execute(JSC::MarkingConstraintSolver::SchedulerPreference, WTF::ScopedLambda<WTF::Optional<unsigned int> ()>) (MarkingConstraintSolver.cpp:66)
==654==    by 0x68F4033: JSC::MarkingConstraintSolver::drain(WTF::BitVector&) (MarkingConstraintSolver.cpp:97)
==654==    by 0x68F4B2F: JSC::MarkingConstraintSet::executeConvergenceImpl(JSC::SlotVisitor&) (MarkingConstraintSet.cpp:114)
==654==    by 0x68F4C6B: JSC::MarkingConstraintSet::executeConvergence(JSC::SlotVisitor&) (MarkingConstraintSet.cpp:83)
==654==    by 0x68D9BC7: JSC::Heap::runFixpointPhase(JSC::GCConductor) (Heap.cpp:1378)
==654==    by 0x68D9E93: runCurrentPhase (Heap.cpp:1208)
==654==    by 0x68D9E93: JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) (Heap.cpp:1176)
==654==  Uninitialised value was created by a stack allocation
==654==    at 0x5AC3E80: JSC::ARM64Assembler::linkJump(JSC::AssemblerLabel, JSC::AssemblerLabel, JSC::ARM64Assembler::JumpType, JSC::ARM64Assembler::Condition) [clone .isra.0] (ARM64Assembler.h:2556)

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-24 22:22:12 +02:00
Adrian Perez de Castro
32b53a23e8 package/wpewebkit: bump to version 2.32.2
Bugfix release, mainly solves a few issues with input events and a
few crashes. Release notes:

  https://wpewebkit.org/release/wpewebkit-2.32.2.html

The patch for building against uClibc has been included in this release,
therefore "0001-Support-building-against-uClibc.patch" is removed.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2021-07-16 23:26:19 +02:00
Adrian Perez de Castro
35eb9b566a package/wpewebkit: import patch to support uclibc
Import a small patch from the upstream Bugzilla which is needed to allow
building WPE WebKit against uClibc.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[yann.morin.1998@free.fr: add upstream commit refs in backported patch]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-06-04 22:38:42 +02:00
Adrian Perez de Castro
2e53ee4f01 package/wpewebkit: make gst-gl depend on _HAS_PLATFORM
The GStreamer-GL usage in WPE WebKit is usable as long as GStreamer
is configured with a valid platform API (GLX+OpenGL, EGL+OpenGL,
EGL+GLES, etc.), which is exactly what the symbol
BR2_PACKAGE_GST1_PLUGINS_BASE_LIB_OPENGL_HAS_PLATFORM represents.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-05-21 18:52:17 +02:00
Adrian Perez de Castro
ad9d1332dc package/wpewebkit: select gstreamer autoaudiosink
Select BR2_PACKAGE_GST1_PLUGINS_GOOD_PLUGIN_AUTODETECT when multimedia
support is enabled. This is needed at runtime to automatically select
a suitable audio output element, otherwise WebKit will crash at an
assertion due to the missing "autoaudiosink" element. More here:

  https://wpewebkit.org/about/faq.html#why-does-the-browser%2Flauncher-(e.g.-cog)-crash-when-trying-to-play-audio%3F

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-05-21 18:49:11 +02:00
Adrian Perez de Castro
d35e4a9744 package/wpewebkit: bump to version 2.32.1
Update to a new major release which brings in improvements and a few new
features. Release notes:

  https://wpewebkit.org/release/wpewebkit-2.32.0.html
  https://wpewebkit.org/release/wpewebkit-2.32.1.html

None of the new features in WPE WebKit 2.32.x need additional
dependencies.

The existing patch for Musl compatibility is not needed anymore because
a better solution has been accepted upstream and backported to be
included in the 2.32.1 release.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-05-18 18:47:58 +02:00
Adrian Perez de Castro
26437a51e1 package/wpewebkit: security bump to 2.30.6
This is a minor release which provides fixes for CVE-2020-27918,
CVE-2020-29623, CVE-2021-1765, CVE-2021-1789, CVE-2021-1799,
CVE-2021-1801, and CVE-2021-1870.

Full release notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.30.6.html

An accompanying security advisory has been published at:

  https://wpewebkit.org/security/WSA-2021-0002.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-03-28 10:22:56 +02:00
Peter Korsgaard
824473576e package/wpewebkit: bump version to 2.30.5
Bugfix release, fixing a number of issues:

- Fix RunLoop objects leaked in worker threads.
- Fix JavaScriptCore AArch64 LLInt build with JIT disabled.
- Use Internet Explorer quirk for Google Docs.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-02-16 21:51:28 +01:00
Fabrice Fontaine
6e8e829a27 package/wpewebkit: add CPE variables
cpe:2.3🅰️wpewebkit:wpe_webkit is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Awpewebkit%3Awpe_webkit

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2021-01-28 17:43:12 +01:00
Adrian Perez de Castro
81a9e9064f package/wpewebkit: security bump to version 2.30.4
This is a minor release which provides a fix for CVE-2020-13543.

Full release notes:

  https://wpewebkit.org/release/wpewebkit-2.30.4.html

A detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2020-0009.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-12-23 22:31:16 +01:00
Adrian Perez de Castro
445b03fb9b package/wpewebkit: bump to version 2.30.3
This is a minor release which solved a build issues and fixes a number
of rendering issues. Release notes:

  https://wpewebkit.org/release/wpewebkit-2.30.3.html

Patch "0002-WebProcess-InjectedBundle-fix-compile-without-video-.patch"
can be removed because a similar fix is included in this release.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-22 15:25:55 +01:00
Peter Seiderer
6e5f672139 package/wpewebkit: fix compile without video support
Fixes:

  - https://bugs.busybox.net/show_bug.cgi?id=13306

      .../wpewebkit-2.30.2/Source/WebKit/WebProcess/InjectedBundle/InjectedBundle.cpp:242:30: error: ‘class WebCore::Settings’ has no member named ‘setGenericCueAPIEnabled’; did you mean ‘setBeaconAPIEnabled’?
                   page->settings().setGenericCueAPIEnabled(enabled);
                                    ^~~~~~~~~~~~~~~~~~~~~~~
                                    setBeaconAPIEnabled

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-12 22:32:38 +01:00
Adrian Perez de Castro
b98934170e package/wpewebkit: add optional systemd dependency
WPE WebKit 2.30.0 added an USE_SYSTEMD buil option, which needs to
be set to avoid CMake from trying to use systemd unconditionally.

Based on a similar patch for package/webkitgtk by Peter Seiderer.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-10 23:19:19 +01:00
Adrian Perez de Castro
6fdfd5326a package/wpewebkit: bump to version 2.30.2
This is a minor release which fixes a few build and networking issues.
Release notes:

  https://wpewebkit.org/release/wpewebkit-2.30.2.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-10-25 10:03:28 +01:00
Adrian Perez de Castro
f8eaccdddc package/wpewebkit: disable JIT for ARMv5 and ARMv6
WebKit's JavaScriptCore does not support using JIT nor the LLint
interpreter on ARMv5 and ARMv6, so add those two cases when checking
for target CPUs which need to use the CLoop interpreter.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-10-25 09:56:49 +01:00
Adrian Perez de Castro
7a66e3e189 package/wpewebkit: fix build with ENABLE_C_LOOP=ON
The ENABLE_C_LOOP option conflicts with ENABLE_SAMPLING_PROFILER, so
the WebKit CMake build system will emit an error when both are enabled
at the same time. To avoid hitting that situation, explicitly disable
ENABLE_SAMPLING_PROFILER as needed.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-10-25 09:56:45 +01:00
Adrian Perez de Castro
371f6744e5 package/wpewebkit: bump to version 2.30.1
Update to a new major release which bring in many improvements and new
features. The .0 version is skipped because it includes a regression
which was fixed by the .1 release. For a complete list of changed,
please refer to the release notes:

  https://wpewebkit.org/release/wpewebkit-2.30.0.html
  https://wpewebkit.org/release/wpewebkit-2.30.1.html

None of the new features in WPE WebKit 2.30.x need additional dependencies.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-09-22 21:41:00 +02:00
Adrian Perez de Castro
4416e0e7ba package/wpewebkit: security bump to version 2.28.4
This is a minor release which provides fixes for CVE-2020-9862,
CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, and
CVE-2020-9925.

Full release notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.28.4.html

A detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2020-0007.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-07-31 09:11:52 +02:00
Adrian Perez de Castro
aa2c6cfd31 package/wpewebkit: security bump to version 2.28.3
This is a minor release which provides fixes for CVE-2020-9800,
CVE-2020-9802, CVE-2020-9803, CVE-2020-9805, CVE-2020-9806,
CVE-2020-9807, CVE-2020-9843, CVE-2020-9850, and CVE-2020-13753.

Updating from 2.28.2 also brings in the usual batch of fixes, including
important improvements to threading in the media player. Full release
notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.28.3.html

A detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2020-0006.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-07-11 15:59:21 +02:00
Fabrice Fontaine
23fdcb4cbd package/icu: needs gcc >= 4.9 and host gcc >= 4.9
icu uses std::max_align_t since version 67-1 and
a3078fb8c8

This raises the following build failure with gcc 4.8:

utext.cpp:572:5: error: 'max_align_t' in namespace 'std' does not name a type
     std::max_align_t    extension;
     ^

This build failure is due to GCC bug 56019:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=56019

Instead of adding BR2_TOOLCHAIN_HAS_GCC_BUG_56019, just bumps gcc
dependency from 4.8 to 4.9

As this issue also affects host-icu, add a host gcc >= 4.9 dependency

Fixes:
 - http://autobuild.buildroot.org/results/6d2658a3c165c99df3eae87b2970e738bd386245
 - http://autobuild.buildroot.org/results/d204f1a528765d1440620a1eed8c29cbb5ec93c3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-06-18 22:14:18 +02:00
Adrian Perez de Castro
e028d52b7e package/wpewebkit: security bump to version 2.28.2
This is a minor release which provides fixes for CVE-2020-11793,
CVE-2020-3887, CVE-2020-3894, and CVE-2020-3899.

Updating from 2.28.0 also brings a few rendering fixes, a build fix
on MIPS64, a build fix for GStreamer 1.12, and solves a couple of
crashes. The full release notes covering 2.28.1 and 2.28.2 can be
found at:

  https://wpewebkit.org/release/wpewebkit-2.28.1.html
  https://wpewebkit.org/release/wpewebkit-2.28.2.html

A detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2020-0004.html

Note that the above does not cover all the CVEs, and a new advisory
including them is expected to be published in the next days.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2020-04-26 21:55:16 +02:00
James Hilliard
cd75229976 package/wpewebkit: bump to version 2.28.0
Adjust fix build with musl patch for 2.28.0.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2020-03-29 22:03:07 +02:00
Peter Korsgaard
abafaedd05 package/wpewebkit: security bump to version 2.26.4
Fixes the following security issues:

- CVE-2020-3862: Impact: A malicious website may be able to cause a denial
  of service.  Description: A denial of service issue was addressed with
  improved memory handling.

- CVE-2020-3864: Impact: A DOM object context may not have had a unique
  security origin.  Description: A logic issue was addressed with improved
  validation.

- CVE-2020-3865: Impact: A top-level DOM object context may have incorrectly
  been considered secure.  Description: A logic issue was addressed with
  improved validation.

- CVE-2020-3867: Impact: Processing maliciously crafted web content may lead
  to universal cross site scripting.  Description: A logic issue was
  addressed with improved state management.

- CVE-2020-3868: Impact: Processing maliciously crafted web content may lead
  to arbitrary code execution.  Description: Multiple memory corruption
  issues were addressed with improved memory handling.

For more details, see the advisory:
https://wpewebkit.org/security/WSA-2020-0002.html

While we are at it, adjust the white space in the .hash function to match
the new agreements.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-02-16 12:54:51 +01:00
Peter Korsgaard
09af6d8bfd package/wpewebkit: needs >= GCC 7
CMakeLists.txt contains a toolchain check:

if (${CMAKE_CXX_COMPILER_ID} STREQUAL "GNU")
    if (${CMAKE_CXX_COMPILER_VERSION} VERSION_LESS "7.3.0")
        message(FATAL_ERROR "GCC 7.3 or newer is required to build WebKit. Use a newer GCC version or Clang.")
    endif ()
endif ()

So bump the toolchain dependency to >= GCC 7.  The check is really about >=
7.3.0, but we do not have such detailed version checks.  Given that GCC
7.3.0 was released in January 2018 (and 7.1.0 in May 2017), most external
GCC 7.x toolchains probably use >= 7.3.0.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-02-16 12:54:45 +01:00
Adrian Perez de Castro
f779520a63 package/wpewebkit: disable JSC JIT for MIPSr6
Forcibly disable the JavaScriptCore JIT compilation support
for MIPSr6 processors, which are unsupported.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-02-11 23:33:52 +01:00
Peter Korsgaard
9412a38fec package/wpewebkit: security bump to version 2.26.3
Fixes the following security issues:

- CVE-2019-8835: Multiple memory corruption issues were addressed with
  improved memory handling

- CVE-2019-8844: Multiple memory corruption issues were addressed with
  improved memory handling

- CVE-2019-8846: A use after free issue was addressed with improved memory
  management

For details, see the advisory:
https://webkitgtk.org/security/WSA-2020-0001.html

Drop now upstreamed patch.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-28 23:26:35 +01:00
James Hilliard
8f8abbeec3 package/wpewebkit: Fix build with icu 65.1
Add patch to fix build issue introduced in buildroot commit
e2a2fab11b which bumped ICU to
version 65.1.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-01-21 21:05:44 +01:00
Adrian Perez de Castro
2a19afecb4 package/wpewebkit: add option to enable sandboxing support
Add an option to enable WebKit's sandbox, which uses kernel
namespaces to isolate the processes used for Web content rendering
(WebKitWebProcess) and network/disk access (WebKitNetworkProcess).

The reason to have an option is that it needs additional dependencies
(bubblewrap, xdg-dbus-proxy, libseccomp), and that some users may
choose to deploy alternative solution (for example: putting all
of WebKit inside its own container, using systemd-nspawn or the
like).

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[Peter: select libseccomp]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-12-15 21:33:56 +01:00
Adrian Perez de Castro
f3546d4e7c package/wpewebkit: security bump to version 2.26.2
This is a minor release which includes fixes for CVE-2019-8812 and
CVE-2019-8814.

This release also fixes the build with WebDriver disabled, making patch
"0002-WPE-GTK-Build-fails-with-ENABLE_WEBDRIVER-OFF.patch" unneeded
(and therefore removed). There is also a performance improvement for
a regression related to fallback font selection, and a couple of small
fixes. The full release notes are available at:

  https://wpewebkit.org/release/wpewebkit-2.26.2.html

The detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2019-0006.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-11-15 23:35:21 +01:00
Yann E. MORIN
55fc80260b packages: host gcc >= 4.8 is now guaranteed
... so we can drop all config options about it and previous versions.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-27 10:00:29 +01:00
Adrian Perez de Castro
223a5876e0 package/wpewebkit: fix build without WebDriver
Add "0002-WPE-GTK-Build-fails-with-ENABLE_WEBDRIVER-OFF.patch", which is
a slightly edited version of an upstream patch that fixes building WPE
WebKit with ENABLE_WEBDRIVER=OFF.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-10-08 23:16:38 +02:00
Adrian Perez de Castro
53f87c514e package/wpewebkit: bump to version 2.26.1
Release notes:

  https://wpewebkit.org/release/wpewebkit-2.26.1.html

This is a bugfix release which fixes a few issues deteted in 2.26.0
and includes media playback improvements as well.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-09-30 22:18:46 +02:00
Adrian Perez de Castro
5d68b3fa22 package/wpewebkit: bump to version 2.26.0
This is a new major release which brings in many improvements and new
features. For a complete list, please refer to the release notes:

  https://wpewebkit.org/release/wpewebkit-2.26.0.html

The new support for accessibility and the Bubblewrap sandbox need
additional dependencies and therefore are explicitly disabled at the
moment.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-09-28 23:29:59 +02:00
Adrian Perez de Castro
c38766d6a6 package/wpewebkit: security bump to version 2.24.3
This is a minor release which includes fixes for CVE-2019-8644,
CVE-2019-8649, CVE-2019-8658, CVE-2019-8666, CVE-2019-8669,
CVE-2019-8673, CVE-2019-8676, CVE-2019-8678, CVE-2019-8680,
CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8687,
CVE-2019-8688, CVE-2019-8689, and CVE-2019-8690.

This release also contains many build fixes, a few media playback
improvements, and a Web compatibility fix. For a complete list,
the full release notes are available at:

  https://wpewebkit.org/release/wpewebkit-2.24.3.html

The detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2019-0004.html

Patch "0001-Build-failure-after-r243644-in-GTK-Li.patch" is now unneeded
because it is one of the build fixes included in this release.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-08-30 16:39:32 +02:00
James Hilliard
c0b32cf11e package/wpewebkit: fix gstreamer-gl dependency
The gstreamer1 opengl plugin was moved from gst1-plugins-bad to
gst1-plugins-base so we need to update wpewebkit to depend on the
correct package.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
[Thomas: don't add gst1-plugins-base to the DEPENDENCIES variable when
BR2_PACKAGE_WPEWEBKIT_USE_GSTREAMER_GL is enabled, because it's
already added when BR2_PACKAGE_WPEWEBKIT_MULTIMEDIA=y, and
BR2_PACKAGE_WPEWEBKIT_USE_GSTREAMER_GL depends on
BR2_PACKAGE_WPEWEBKIT_MULTIMEDIA.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-08-07 15:18:44 +02:00
James Hilliard
11a290b589 package/gstreamer1/gst1-plugins-bad: add wpe plugin option
Removed gst1-plugins-bad dependency from wpewebkit gstreamer-gl option
so that there isn't a circular dependency with gst1-plugins-bad.

It appears that wpewebkit gstreamer-gl only has a runtime dependency on
gst1-plugins-bad.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2019-06-08 22:41:18 +02:00
Peter Korsgaard
f590097045 Merge branch 'next'
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-06-02 22:11:20 +02:00
Fabrice Fontaine
4e9fba9741 package/wpewebkit: fix build with musl
Fixes:
 - http://autobuild.buildroot.org/results/c703d45ab691641beabc3440f081a8bc195b4a23

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2019-06-01 12:37:08 +02:00