Commit Graph

50649 Commits

Author SHA1 Message Date
Peter Korsgaard
6f01c28f05 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 6}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7616ce3e46)
[Peter: drop 5.5.x / 5.6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-11 21:18:32 +02:00
Fabrice Fontaine
e3d7d0371f package/libvncserver: fix CVE-2019-20788
libvncclient/cursor.c in LibVNCServer through 0.9.12 has a
HandleCursorShape integer overflow and heap-based buffer overflow via a
large height or width value. NOTE: this may overlap CVE-2019-15690.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 705adbaf9a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-11 21:14:45 +02:00
Angelo Compagnucci
7c74a3e3f0 linux: bump CIP, CIP RT hashes
Bumping the hashes for CIP and CIP RT.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fb8186d53e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-11 21:14:09 +02:00
Angelo Compagnucci
a99fe9928b linux: bump CIP RT kernel to version 4.19.115-cip24-rt9
This patch bumps Linux CIP RT version to 4.19.115-cip24-rt9.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2452aa182d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-11 21:13:42 +02:00
Angelo Compagnucci
cf23a44ddd linux: bump CIP kernel to version 4.19.118-cip25
This patch bumps Linux CIP version to v4.19.118-cip25.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1b53b94690)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-11 21:13:16 +02:00
Peter Seiderer
3e744db3d0 package/squashfs: fix host compile multiple definitions
Add upstream patch to fix squashfs-tools build failures because
of missing external declaration for fwriter_buffer and
bwriter_buffer.

Fixes:

  - http://autobuild.buildroot.net/results/6789b668898245926e0a3a3e7caf823dff515d71

  /usr/bin/ld: read_fs.o:(.bss+0x0): multiple definition of `fwriter_buffer'; mksquashfs.o:(.bss+0x400c90): first defined here
  /usr/bin/ld: read_fs.o:(.bss+0x8): multiple definition of `bwriter_buffer'; mksquashfs.o:(.bss+0x400c98): first defined here

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8d7b714027)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:46:24 +02:00
Peter Seiderer
1cc9fbe1f6 package/libv4l: fix input_event related compile failure
Add two upstream patches fixing input_event time related
compile failures.

Fixes:

 - http://autobuild.buildroot.net/results/3883a948e30cfd235cfca1fb8646fe8032f5e18d

  keytable.c: In function 'test_event':
  keytable.c:1536:11: error: 'struct input_event' has no member named 'time'; did you mean 'type'?
       ev[i].time.tv_sec, ev[i].time.tv_usec,
             ^~~~
             type
  keytable.c:1536:30: error: 'struct input_event' has no member named 'time'; did you mean 'type'?
       ev[i].time.tv_sec, ev[i].time.tv_usec,
                                ^~~~
                                type

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cd27ee0a58)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:43:54 +02:00
Fabrice Fontaine
b17cbc4498 package/cvs: add license
cvs is an old package, and it shows:

  - CVS is licensed under GPL-1.0+ as stated in README (referenced in source
    code) and COPYING files;

  - COPYING.LIB also give the terms of LGPL-2.0+, and is referenced by a
    few files, like lib/strnlen1.c, mostly vampirised rom older versions
    of the GNU C library (glibc);

  - additionally, the glob implementation was also grabbed from a more
    recent (but still old) glibc version, and is LGPL-2.1+, but there is
    no license file associated with it, so we use the header instead.

Also update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr:
  - LGPL-2.0+ is used, reference at least one file
  - LGPL-2.1+ is also used
  - reword commit log accordingly
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 449ac1b6cb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:39:00 +02:00
Asaf Kahlon
730326aec2 package/python-attrs: fix typo in hash file
'computer' -> 'computed'.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e86a6ab35a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:35:23 +02:00
Romain Naour
e89604a806 package/irrlicht: disable bundled libpng NEON support
Irrlicht fail to detect properly the NEON support on aarch64 or ARM with NEON FPU support.
While linking an application with libIrrlicht.so, we get an undefined reference to
png_init_filter_functions_neon.
Some files are missing in the libpng bundled in Irrlicht, in particular arm/arm_init.c [1],
so disable NEON support completely.

This can be reproduced by building minetest using this defconfig for aarch64:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_MINETEST=y
BR2_PACKAGE_MINETEST_CLIENT=y
BR2_PACKAGE_MINETEST_SERVER=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y

Or for ARM with NEON FPU support:
BR2_arm=y
BR2_cortex_a15=y
BR2_ARM_FPU_NEON=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_MINETEST=y
BR2_PACKAGE_MINETEST_CLIENT=y
BR2_PACKAGE_MINETEST_SERVER=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y

[1] https://github.com/glennrp/libpng/tree/v1.6.37/arm

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bf5f4f417a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:33:57 +02:00
Fabrice Fontaine
6a4097caf5 package/ffmpeg: fix CVE-2020-12284
cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4.2.2 has a
heap-based buffer overflow during JPEG_MARKER_SOS handling because of a
missing length check.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit aab52d8722)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:32:45 +02:00
Fabrice Fontaine
e59503a9d8 package/suricata: fix build with lua
Fixes:
 - http://autobuild.buildroot.net/results/11bc7f4e1c54f074dd10a995233bee45c293e488

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e0fbbdb6fc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:07:38 +02:00
Fabrice Fontaine
4a71c673f1 package/util-linux: accept sector-size
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=12841

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit af787a4cf5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:04:16 +02:00
Fabrice Fontaine
c77166012b package/util-linux: renumber patches
Commit 3052da3eac did not renumber
remaining patches, fix that

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit df2f438616)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:01:37 +02:00
Yann E. MORIN
8b31a049b1 support/gnuconfig: reference the correct sha1 we're using
In commit ff9f778c66 (support/gnuconfig: update to 2019-05-28), we
forgot to update the README to reference the sha1 we're using, keeping
the old one from 2016...

Update it now.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3bf545da78)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:55:47 +02:00
Fabrice Fontaine
a2220778b1 package/freerdp: security bump to version 2.1.0
- Drop patch (already in version)
- Fix multiple CVEs: CVE-2020-11039, CVE-2020-11038, CVE-2020-11043,
  CVE-2020-11040, CVE-2020-11041, CVE-2020-11019, CVE-2020-11017,
  CVE-2020-11018
- Fix multiple leak and crash issues (#6129, #6128, #6127, #6110, #6081,
  #6077)

Extracted from:
65d3ff4461

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8c26ce8539)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:54:00 +02:00
Fabrice Fontaine
f8f7b417ef package/matchbox: add hash for license file
Add hash for license file, add sha256 for tarball and update indentation
for hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7f59e2c01a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:51:39 +02:00
Fabrice Fontaine
d914cd2c6a package/matchbox: add missing expat dependency
matchbox selects expat but does not add it to its dependency resulting
in the following build failure:

configure: error: cannot find expat library
make: *** [/home/buildroot/autobuild/run/instance-2/output-1/build/matchbox-1.2/.stamp_configured] Error 1

Fixes:
 - http://autobuild.buildroot.org/results/37021f1d7fcfd890011068a28ce6181dc509e746

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3a784f49eb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:51:14 +02:00
Yann E. MORIN
61f5bceb52 release: don't include temp files
When we prepare the release, we generate the manual in various formats,
so that it can be consulted locally without needing the miriads of tools
needed to generate it.

However, this creates the temporary .br2-external.* files in the output
directory, and those end up in the release tarball.

This is not a problem in practice, but is not clean.

Run 'distclean' in the output directory, to get rid of everything but
the generated documentation.

Reported-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bee47598aa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:34:50 +02:00
Fabrice Fontaine
8616ca9f17 package/domoticz: set WITH_LIBUSB
Use WITH_LIBUSB which is available since version 4.9700 and
f53817577a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a896be19de)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:31:50 +02:00
Fabrice Fontaine
eec5fb6419 package/squid: security bump to version 4.11
Fix CVE-2020-11945: An issue was discovered in Squid before 5.0.2. A
remote attacker can replay a sniffed Digest Authentication nonce to gain
access to resources that are otherwise forbidden. This occurs because
the attacker can overflow the nonce reference counter (a short integer).
Remote code execution may occur if the pooled token credentials are
freed (instead of replayed as valid credentials).

http://www.squid-cache.org/Advisories/SQUID-2020_4.txt

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b365c64236)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:30:41 +02:00
Matt Weber
8fc8ca203a package/libsepol: fix -fno-common build failures
GCC10 as a host complier has started to trigger these failures

 Add upstream patch for
    libsepol: remove leftovers of cil_mem_error_handler
    libsepol: fix CIL_KEY_* build errors with -fno-common

Fixes:
http://autobuild.buildroot.net/results/1ebeed4bb1b0f5bca493ff687f879367eaeaf868

Cc: Romain Naour <romain.naour@gmail.com>
Cc: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:29:03 +02:00
Luca Ceresoli
4314359b28 package/exim: fix parallel build
exim does build in parallel correctly, but has a concurrency bug in
generating version info files which happens either in the build step or in
the install step.

Add a patch to fix the bug.

Fixes:
  http://autobuild.buildroot.net/results/ebf/ebfccad007e216564889645a07f5487747116331//
  http://autobuild.buildroot.net/results/56a/56a8457efcb32579ad6da99a769b6438dd0db267//
  http://autobuild.buildroot.net/results/6a1/6a1f8a352649baf767b094cb6bbe2a7397fa7fac//
  http://autobuild.buildroot.net/results/5ed/5ed1c42b3d33198f32d1267e5cc2b1fa1211495a//
  http://autobuild.buildroot.net/results/b30/b304569948fd481ce33ecd052a1036153c5d459e//
  http://autobuild.buildroot.net/results/d2c/d2c7abfe08672e53ff890127f787f8d2e84860f4//

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8c75f95e0a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:24:53 +02:00
Romain Naour
78296a0502 package/qemu: disable curl for the host variant
Under certain circumstances (host distribution, openssl version),
the qemu-system binary fail to start:

qemu-system-aarch64: symbol lookup error: /lib64/libssh.so.4: undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b

There is no problem when only host-qemu is built, but it's linked with /lib64/libcurl.so.4
$ make host-qemu
$ ldd output/host/bin/qemu-system-aarch64
        [...]
	libcurl.so.4 => /lib64/libcurl.so.4 (0x00007fb21cb57000)
	libssh.so.4 => /lib64/libssh.so.4 (0x00007fb21c35d000)
	libpsl.so.5 => /lib64/libpsl.so.5 (0x00007fb21c34a000)
	libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fb21c2b4000)

Note: /lib64/libcurl.so.4 is linked with libssh and libssl:
$ ldd /lib64/libcurl.so.4
	[...]
	libssh.so.4 => /lib64/libssh.so.4 (0x00007f90d8efd000)
	libpsl.so.5 => /lib64/libpsl.so.5 (0x00007f90d8eea000)
	libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f90d8e54000)

Continue the build.
$ make

We can notice that qemu_aarch64_virt_defconfig set
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y

So host-openssl package is built and this is the problem:

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libcurl.so.4 => /lib64/libcurl.so.4 (0x00007f3adb444000)
	libssh.so.4 => /lib64/libssh.so.4 (0x00007f3adac4a000)
	libpsl.so.5 => /lib64/libpsl.so.5 (0x00007f3adac37000)
	libssl.so.1.1 => /home/naourr/buildroot/test/qemu_aarch64_virt_defconfig-master/host/lib/libssl.so.1.1 (0x00007f3adaba8000)

qemu-system-aarch64: symbol lookup error: /lib64/libssh.so.4: undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b

This is due to the build system trying to find libcurl using
pkg-config or curl-config.

libcurl is used by the QEMU Block driver for CURL images and
elf2dmp tool which is not needed.
Instead of adding host-libcurl dependency, we can disable it
entierely.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e30eaeb10e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:22:58 +02:00
Romain Naour
15b41bb802 package/qemu: enable or1k support in host-qemu
This change enables host qemu support for or1k which among other
things allows to test this architecture in gitlab.

The or1k support was named or32 until Qemu 2.9.0 and then renamed or1k
in upstream commit [1]. Since we're already using Qemu 4.2.0, we use
the or1k name.

Tested using qemu_or1k_defconfig.

[1] https://git.qemu.org/?p=qemu.git;a=commit;h=4a09d0bb34ab030e09e87173b2e3ec0fd7616cff

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a41fae16d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:22:21 +02:00
Romain Naour
9ca889a2c1 package/qemu: disable SDL2 for the host variant
There is no host variant for SDL2 library in Buildroot.
So the qemu build system will try to detect automatically the
external SDL2 libraries installed on the host.

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libSDL2-2.0.so.0 => /lib64/libSDL2-2.0.so.0

Disable explicitely sdl2 options (named sdl) to improve the
build reproducibility.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 44e5da60b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:21:51 +02:00
Romain Naour
f2e2ac81e2 package/qemu: disable bzip2 for the host variant
bzip2 support is needed for reading bzip2-compressed dmg images.

But the host-bzip2 is missing from host qemu package dependency,
so the qemu build system will try to detect automatically the
external libbzip2 libraries installed on the host.

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libbz2.so.1 => /lib64/libbz2.so.1
or
	libbz2.so.1.0 => output/host/lib/libbz2.so.1.0
if host-bzip2 is built before host-qemu.

Disable explicitely bzip2 options to improve the build
reproducibility.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 743fceb2ed)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:21:10 +02:00
Romain Naour
1df0dd3cb0 package/qemu: disable vnc optional support for the host variant
The vnc support is enabled by default and the build system
will try to detect automatically some external libraries
installed on the host for vnc-png, vnc-jpeg and vnc-sasl.

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libpng16.so.16 => /lib64/libpng16.so.16
or
	libpng16.so.16 => output/host/lib/libpng16.so.16
if host-libpng is built before host-qemu.

Disable explicitely thoses options to improve the build
reproducibility.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ece36b9a46)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:20:57 +02:00
Romain Naour
84e768acf2 package/qemu: disable libssh for the host variant
There is no host-libssh in Buildroot, avoid qemu build system
to find libssh from the host.

Under certain circumstances (host distribution, openssl version), the
qemu-system binary fail to start:

host/bin/qemu-system-aarch64: symbol lookup error: /lib64/libssh.so.4: undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libssh.so.4 => /lib64/libssh.so.4

Explicitely disable libssh for the host variant.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0c4a80c7c4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:20:39 +02:00
Bernd Kuhls
ad120f7335 package/libfm-extra: fix dependency comment
According to the depends used the package does not need C++.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 08935f2a86)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:16:36 +02:00
Davide Viti
a975326ca4 DEVELOPERS: adjust e-mail address for Davide Viti
Previous address is still valid but not used as primary address any
longer

Signed-off-by: Davide Viti <zinosat@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3d1583729c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:15:47 +02:00
Alexey Lukyanchuk
578f0936f2 package/qpdf: fix 'no such file' exeption
Without a source for randomness, qpdf will crash with 'no such file'
error. It's can me tested by command like 'qpd some_pdf.pdf -'.
This problem breaks cups printing.

This patch change configure options to '--with-random=/dev/urandom'

Signed-off-by: Alexey Lukyanchuk <skif@skif-web.ru>
[yann.morin.1998@free.fr: reword commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 69dfbbd33b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:12:29 +02:00
Michele Comignano
d883e860b1 package/vlc: enable gnutls if selected
Signed-off-by: Michele Comignano <comick@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8d3a5da884)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:12:04 +02:00
Fabrice Fontaine
006165909d package/paho-mqtt-c: fix build without C++
Fixes:
 - http://autobuild.buildroot.org/results/831ecc34b51ee2be82a3c25f5ec94f0dd2103655

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit dd63d5822d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:54:57 +02:00
Fabrice Fontaine
1c6df588db package/suricata: security bump to version 4.1.8
- This is the first release after Suricata joined the Oss-Fuzz program,
  leading to discovery of a number of (potential) security issues:
  https://suricata-ids.org/2020/04/28/suricata-4-1-8-released
- Drop first, second and fourth patches (already in version)
- Update indentation of hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6138dee5e7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:27:02 +02:00
Fabrice Fontaine
1c7c8303e6 package/libhtp: security bump to version 0.5.33
- ChangeLog:
  - compression bomb protection
  - memory handling issue found by Oss-Fuzz
  - improve handling of anomalies in traffic
- Drop first patch (already in version)
- Update indentation of hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b3d5194696)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:26:32 +02:00
Dagg Stompler
c99a2b0a48 board/hardkernel/odroidc2: remove unused files
Commit b80712a16a ("configs/odroidc2:
remove the defconfig") has removed the odroidc2 defconfig, but left
behind a number of files in board/hardkernel/odroidc2, which are now
unused. Let's remove them.

Signed-off-by: Dagg Stompler <daggs@gmx.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 197da62866)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:25:35 +02:00
Fabrice Fontaine
c53538af04 package/paho-mqtt-c: fix build on uclibc or musl
Fixes:
 - http://autobuild.buildroot.org/results/4beb96d43180813906578b42875a1c3d4a905ed7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 91beea442a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:24:06 +02:00
Bernd Kuhls
2a9f241a83 package/samba4: security bump version to 4.11.8
Reformatted hash.

Fixes CVE 2020-10700 & CVE 2020-10704.

Release notes: https://www.samba.org/samba/history/samba-4.11.8.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 11bc27fd0d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:23:07 +02:00
Asaf Kahlon
50f20f639e docs: adding-packages-python: don't mention distutilscross
The package was removed a long time ago.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 427697f297)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:01:19 +02:00
Carlos Santos
04df6eba78 DEVELOPERS: trim Carlos Santos' watch list
- I fixed build problems on cups and cups-filters but don't use them.

- gtest, libpam-radius-auth, libpam-tacplus and perl-file-util were
  used in my previous job. I don't have access to the packages that
  use them neither to the corresponding test infrastructure anymore.

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1c3ffaed57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:00:24 +02:00
Yann E. MORIN
0cba056b9c package/tzdata: do extract to get the license file
Back in 2014, about 6 years ago now, in my infinite wisdom, I
decided that extracting the tzdata source was not necessary for
the target variant, because we would be installing the files
generated by the host variant, in commit 7aad5daa5d (package/tzdata:
only compile the zoneinfo once).

However, that did not account for the fact that we would eventually
like to have the licensing information for tzdata, later added in
2019, in commit 60889ccdf0 (package/tzdata: bump to version 2019b).

However, that last comit only added the license file to the host
variant, without explanations why that was so. It turns out that the
reason it was not added to the target variant is, probably, that he
source code for the target variant is not extracted, and thus saving
the license file fails.

But we really want the license file for what goes on into the target.

So, do extract the source code for the target variant, even if only to
get the license file.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Richard Braun <rbraun@sceen.net>
Cc: Martin Bark <martin@barkynet.com>
Cc: Christopher McCrory <chrismcc@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5c0c4861be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 19:56:50 +02:00
Alexander Dahl
12581af61c package/zic: bump to version 2020a
Signed-off-by: Alexander Dahl <post@lespocky.de>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2f976c31b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:20:45 +02:00
Alexander Dahl
69f2f95d52 package/tzdata: bump to version 2020a
Signed-off-by: Alexander Dahl <post@lespocky.de>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7656cae01e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:20:36 +02:00
Adrian Perez de Castro
50a48fd6b3 package/webkitgtk: security bump to version 2.28.2
This is a minor release which provides fixes for CVE-2020-11793,
CVE-2020-3887, CVE-2020-3894, and CVE-2020-3899.

Updating from 2.28.0 also brings a few rendering fixes, a build fix
on MIPS64, a build fix for GStreamer 1.12, and solves a couple of
crashes. The full release notes covering 2.28.1 and 2.28.2 can be
found at:

  https://webkitgtk.org/2020/04/13/webkitgtk2.28.1-released.html
  https://webkitgtk.org/2020/04/24/webkitgtk2.28.2-released.html

A detailed security advisory can be found at:

  https://webkitgtk.org/security/WSA-2020-0004.html

Note that the above does not cover all the CVEs, and a new advisory
including them is expected to be published in the next days.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 080f4251ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:05:40 +02:00
Adrian Perez de Castro
5c3b82b027 package/wpewebkit: security bump to version 2.28.2
This is a minor release which provides fixes for CVE-2020-11793,
CVE-2020-3887, CVE-2020-3894, and CVE-2020-3899.

Updating from 2.28.0 also brings a few rendering fixes, a build fix
on MIPS64, a build fix for GStreamer 1.12, and solves a couple of
crashes. The full release notes covering 2.28.1 and 2.28.2 can be
found at:

  https://wpewebkit.org/release/wpewebkit-2.28.1.html
  https://wpewebkit.org/release/wpewebkit-2.28.2.html

A detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2020-0004.html

Note that the above does not cover all the CVEs, and a new advisory
including them is expected to be published in the next days.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e028d52b7e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:05:34 +02:00
Adrian Perez de Castro
af237ed997 package/webkitgtk: bump to version 2.28.0
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6ebd152853)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:04:51 +02:00
James Hilliard
3cffbc6769 package/wpebackend-fdo: bump to version 1.6.0
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 60992a8ce1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:04:29 +02:00
James Hilliard
a4ac41f92d package/libwpe: bump to version 1.6.0
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 90e735f6d9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:04:22 +02:00
James Hilliard
bbe227dac6 package/wpewebkit: bump to version 2.28.0
Adjust fix build with musl patch for 2.28.0.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cd75229976)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:02:29 +02:00