Commit Graph

63542 Commits

Author SHA1 Message Date
Bernd Kuhls
873c996fc8 package/kodi: fix openrisc build
Fixes build error not yet found by autobuilders

-- System type: Linux
CMake Error at cmake/scripts/linux/ArchSetup.cmake:42 (message):
  Unknown CPU: or1k

with this defconfig:

BR2_or1k=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_OPENRISC_UCLIBC_STABLE=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 86fac589fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 15:01:04 +01:00
Bernd Kuhls
198e35ddab package/kodi: fix armv5 build
Disable neon support when not available.

Fixes build error not yet found by autobuilders

/tmp/cc8LvPwi.s: Assembler messages:
/tmp/cc8LvPwi.s:28: Error: selected processor does not support `vldmia r1,{ q4-q7 }' in ARM mode
/tmp/cc8LvPwi.s:29: Error: selected processor does not support `vldmia r0,{ q8-q11 }' in ARM mode
/tmp/cc8LvPwi.s:30: Error: selected processor does not support `vmul.f32 q0,q8,d8[0]' in ARM mode
/tmp/cc8LvPwi.s:31: Error: selected processor does not support `vmul.f32 q1,q8,d10[0]' in ARM mode
/tmp/cc8LvPwi.s:32: Error: selected processor does not support `vmul.f32 q2,q8,d12[0]' in ARM mode
/tmp/cc8LvPwi.s:33: Error: selected processor does not support `vmul.f32 q3,q8,d14[0]' in ARM mode
/tmp/cc8LvPwi.s:34: Error: selected processor does not support `vmla.f32 q0,q9,d8[1]' in ARM mode
/tmp/cc8LvPwi.s:35: Error: selected processor does not support `vmla.f32 q1,q9,d10[1]' in ARM mode
/tmp/cc8LvPwi.s:36: Error: selected processor does not support `vmla.f32 q2,q9,d12[1]' in ARM mode
/tmp/cc8LvPwi.s:37: Error: selected processor does not support `vmla.f32 q3,q9,d14[1]' in ARM mode
/tmp/cc8LvPwi.s:38: Error: selected processor does not support `vmla.f32 q0,q10,d9[0]' in ARM mode
/tmp/cc8LvPwi.s:39: Error: selected processor does not support `vmla.f32 q1,q10,d11[0]' in ARM mode
/tmp/cc8LvPwi.s:40: Error: selected processor does not support `vmla.f32 q2,q10,d13[0]' in ARM mode
/tmp/cc8LvPwi.s:41: Error: selected processor does not support `vmla.f32 q3,q10,d15[0]' in ARM mode
/tmp/cc8LvPwi.s:42: Error: selected processor does not support `vmla.f32 q0,q11,d9[1]' in ARM mode
/tmp/cc8LvPwi.s:43: Error: selected processor does not support `vmla.f32 q1,q11,d11[1]' in ARM mode
/tmp/cc8LvPwi.s:44: Error: selected processor does not support `vmla.f32 q2,q11,d13[1]' in ARM mode
/tmp/cc8LvPwi.s:45: Error: selected processor does not support `vmla.f32 q3,q11,d15[1]' in ARM mode
/tmp/cc8LvPwi.s:46: Error: selected processor does not support `vstmia r0,{ q0-q3 }' in ARM mode

with this defconfig:

BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV5_EABI_UCLIBC_STABLE=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2952832a40)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-14 13:59:49 +01:00
Fabrice Fontaine
399ca20e6b package/lxc: fix CVE-2022-47952
lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may
allow local users to infer whether any file exists, even within a
protected directory tree, because "Failed to open" often indicates that
a file does not exist, whereas "does not refer to a network namespace
path" often indicates that a file exists. NOTE: this is different from
CVE-2018-6556 because the CVE-2018-6556 fix design was based on the
premise that "we will report back to the user that the open() failed but
the user has no way of knowing why it failed"; however, in many
realistic cases, there are no plausible reasons for failing except that
the file does not exist.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-06 22:42:59 +01:00
Fabrice Fontaine
c2284f82ec package/python-future: security bump to version 0.18.3
Fix CVE-2022-40899: An issue discovered in Python Charmers Future 0.18.2
and earlier allows remote attackers to cause a denial of service via
crafted Set-Cookie header from malicious web server.

https://github.com/PythonCharmers/python-future/releases/tag/v0.18.3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 51eb81ddcf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-06 00:01:29 +01:00
Nicolas Cavallari
66cec4d25c package/libgit2: security bump to 1.5.1
Fixes CVE-2023-22742: when compiled with BR2_PACKAGE_LIBSSH2,
libgit2 fails to verify SSH keys by default.

https://github.com/libgit2/libgit2/blob/v1.5.1/docs/changelog.md

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cc47da516c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:47 +01:00
Nicolas Cavallari
3a7e02bdfd package/libgit2: bump to 1.5.0
It includes an option to build a command line program that can be used
to replace git in simple cases.

The upcoming sha256 repository support made them steal the sha256 code
from RFC6234, hence the license change.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7c8e34f4d2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:39 +01:00
Nicolas Cavallari
6b1a7b69ab package/libgit2: link with -latomic if needed
libgit2 is currently a library without any reverse dependencies so the
missing atomic symbols do not cause build failures yet.

libgit2 uses the atomics intrinsics on gcc >= 4.7 and the sync
intrinsics on previous gcc versions.  Since gcc 4.9 is the new
minimum, ignore the sync intrinsics requirements.

The next version of libgit2 will also build a binary, which will
expose the problem.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e992a3e771)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:31 +01:00
Nicolas Cavallari
89c63ae872 package/libgit2: bump version to 1.4.3
git added restrictions on config files to fix CVE 2022-24765.  libgit2
adopted these changes for compatibility reasons, even if the vuln is
not exploitable in libgit2.

https://github.com/libgit2/libgit2/releases/tag/v1.4.3

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 01ee7f84fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:25 +01:00
Nicolas Cavallari
0683331971 package/libgit2: bump version to 1.4.2
Licence changes mostly concern vendored dependencies (that buildroot does
not use) and a new bundled PRNG used to reimplement mkstemp() - added
CC0 license for that.

Some buildsystem options also changed:
- THREADSAFE is now USE_THREADS
- BUILD_CLAR is now BUILD_TESTS, which the cmake infra already give.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ba8c268e00)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 18:08:19 +01:00
Joachim Wiberg
3909dfbb81 package/ssdp-responder: fix misspelled define directive
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6e0ba6bfc2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 13:30:51 +01:00
Peter Korsgaard
70485003c5 package/git: security bump to version 2.31.6
Fixes the following security issues:

 * CVE-2022-41903:

   git log has the ability to display commits using an arbitrary
   format with its --format specifiers. This functionality is also
   exposed to git archive via the export-subst gitattribute.

   When processing the padding operators (e.g., %<(, %<|(, %>(,
   %>>(, or %><( ), an integer overflow can occur in
   pretty.c::format_and_pad_commit() where a size_t is improperly
   stored as an int, and then added as an offset to a subsequent
   memcpy() call.

   This overflow can be triggered directly by a user running a
   command which invokes the commit formatting machinery (e.g., git
   log --format=...). It may also be triggered indirectly through
   git archive via the export-subst mechanism, which expands format
   specifiers inside of files within the repository during a git
   archive.

   This integer overflow can result in arbitrary heap writes, which
   may result in remote code execution.

 * CVE-2022-23521:

    gitattributes are a mechanism to allow defining attributes for
    paths. These attributes can be defined by adding a `.gitattributes`
    file to the repository, which contains a set of file patterns and
    the attributes that should be set for paths matching this pattern.

    When parsing gitattributes, multiple integer overflows can occur
    when there is a huge number of path patterns, a huge number of
    attributes for a single pattern, or when the declared attribute
    names are huge.

    These overflows can be triggered via a crafted `.gitattributes` file
    that may be part of the commit history. Git silently splits lines
    longer than 2KB when parsing gitattributes from a file, but not when
    parsing them from the index. Consequentially, the failure mode
    depends on whether the file exists in the working tree, the index or
    both.

    This integer overflow can result in arbitrary heap reads and writes,
    which may result in remote code execution.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 13:04:18 +01:00
Bernd Kuhls
fe8c4143f7 package/x11r7/xlib_libXpm: security bump version to 3.5.15
Release notes:
https://lists.x.org/archives/xorg-announce/2023-January/003313.html

Fixes CVE-2022-4883, CVE-2022-44617 & CVE-2022-46285:
https://lists.x.org/archives/xorg-announce/2023-January/003312.html

Updated license hash due to upstream commit:
501494c6c6

Added configure option to disable compressed pixmaps support:
4841039e53

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a0dfd717f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 11:48:58 +01:00
Bernd Kuhls
c9c714a24a package/x11r7/xlib_libXpm: bump version to 3.5.14
https://lists.x.org/archives/xorg-announce/2022-November/003261.html
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7d2fff7804)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-02-05 11:48:52 +01:00
Yair Ben-Avraham
b299ee5f40 package/sudo: security bump to version 1.9.12p2
Fix https://nvd.nist.gov/vuln/detail/CVE-2023-22809

Signed-off-by: Yair Ben-Avraham <yairba@protonmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 51e98499ff)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:29:35 +01:00
Francois Perrad
e2914938c9 package/sudo: bump to version 1.9.12p1
remove merged patch

diff LICENSE.md
-    Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler
+    Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler
-    Copyright (c) 2008-2018, Dave Benson and the protobuf-c authors.
+    Copyright (c) 2008-2022, Dave Benson and the protobuf-c authors.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f095f5a8be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:29:26 +01:00
Fabrice Fontaine
677fbb43b7 package/sudo: bump to version 1.9.11p2
License file renamed and year updated with
0ed92e6165
d02ba52fa4

https://www.sudo.ws/releases/stable/#1.9.11p2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9b7f8da96b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:29:08 +01:00
Bernd Kuhls
080ad9aeda package/apache: security bump version to 2.4.55
Release notes:
https://lists.apache.org/thread/xlp3od60fjl8nl44z4f56y0lhs7pglos

Fixes CVE-2006-20001, CVE-2022-36760, CVE-2022-37436:
https://httpd.apache.org/security/vulnerabilities_24.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 60d8585570)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:26:50 +01:00
Fabrice Fontaine
72c06e1764 package/xxhash: set XXH_NO_INLINE_HINTS
Set XXH_NO_INLINE_HINTS to marks all internal functions as static,
giving the compiler full control on whether to inline or not. This will
fix the following build failure raised since bump to version 0.8.1 in
commit 5dbdb2535c:

In file included from xxhash.c:43:
In function 'XXH3_accumulate',
    inlined from 'XXH3_hashLong_internal_loop' at xxhash.h:4390:9,
    inlined from 'XXH3_hashLong_64b_internal' at xxhash.h:4453:5,
    inlined from 'XXH3_hashLong_64b_withSecret' at xxhash.h:4473:12,
    inlined from 'XXH3_64bits_internal' at xxhash.h:4554:12,
    inlined from 'XXH3_64bits_withSecret' at xxhash.h:4570:12:
xxhash.h:4196:1: error: inlining failed in call to 'always_inline' 'XXH3_accumulate_512_scalar': function not considered for inlining
 4196 | XXH3_accumulate_512_scalar(void* XXH_RESTRICT acc,
      | ^~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/f2c52238df97cc4c13117d8dc1423235231a094c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 94b66fb49c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-29 22:02:50 +01:00
Peter Korsgaard
ae835e094f Update for 2022.02.9
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-18 11:44:24 +01:00
Casey Reeves
e18846284c fs/erofs: enable support for reproducible build
By default, mkfs.erofs will use the current date to set some metadata
in the filesystem it generates, and will also use generate a random UUID
for that filesystem. This is not reproducible.

When BR2_REPRODUCIBLE is selected, set the filesystem timestamps to
$SOURCE_DATE_EPOCH, and the filesystem UUID to the nil uuid (as good
as any other arbitrary one).

Signed-off-by: Casey Reeves <casey@xogium.me>
[yann.morin.1998@free.fr:
  - one multi-line assignment, not two
  - slightly rephrase the commit log
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ac5ecaf868)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-17 10:26:11 +01:00
Peter Korsgaard
a6a0b2c08f package/go: explicitly set GOMODCACHE
go mod vendor caches downloaded modules to the Go module cache, which
defaults to $GOPATH/pkg/mod - But can be overridden with the GOMODCACHE
environment variable:

https://go.dev/ref/mod#module-cache

So explicitly set GOMODCACHE= for reproducibility.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 162f656884)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-17 10:24:36 +01:00
Peter Korsgaard
b007397e80 package/go: set GOCACHE for download post-process
The go mod vendor call in support/download/go-post-process accesses the go
cache, so pass GOCACHE= in the environment to ensure our cache directory is
used.

The go cache defaults to ~/.cache/go-build if not set, so this fixes builds
where that location (or GOCACHE if set in the environment) is not writable:

rm -rf ~/.cache/go-build
chmod -w ~/.cache
make docker-compose-source
..
failed to initialize build cache at /home/peko/.cache/go-build: mkdir /home/peko/.cache/go-build: permission denied
make[1]: *** [package/pkg-generic.mk:189: /home/peko/source/buildroot/output/build/docker-compose-2.14.0/.stamp_downloaded] Error 1

We use two different cache directories for target and host builds, but the
download/vendoring should be independent of the architecture, so use the
target variant even for host-only packages for simplicity.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 07a745e55d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-17 10:24:35 +01:00
Lang Daniel
12dbc6c825 package/at-spi2-core: switch to https download
Signed-off-by: Daniel Lang <d.lang@abatec.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit dde078790a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:52:41 +01:00
Nicolas Carrier
87d8b2e07b package/lpeg: add missing LPEG_LICENSE_FILES
The lpeg.html file declares the licensing terms at its bottom, so it
should work as a license file.

Signed-off-by: Nicolas Carrier <nicolas.carrier@orolia.com>
[yann.morin.1998@free.fr: use LPEG_SUBDIR]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 52afc0b3b5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:42:11 +01:00
Nicolas Carrier
71bb1b27ea package/pkg-generic.mk: no legal info WARNING if REDISTRIBUTE = NO
Packages making use of OVERRIDE_SRC_DIR or of the local SITE_METHOD,
will trigger a warning when the legal-info target is built, for example:

WARNING: foo: sources not saved (local packages not handled)

But in the situation where the packages has explicitly defined
FOO_REDISTRIBUTE = NO
in its .mk file, it makes no sense since the sources wouldn't be saved
anyway.

This patch swap the conditions on the type of package and on the
REDISTRIBUTE value, so that the warnings get issued only if
REDISTRIBUTE equals YES.

Signed-off-by: Nicolas Carrier <nicolas.carrier@orolia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c541df4180)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:42:02 +01:00
Fabrice Fontaine
5b8918a99e package/janus-gateway: add libcurl optional dependency
libcurl is an optional dependency which is enabled by default since at
least version 0.0.9 and
ca9c0a86f9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 60cf07079b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-16 15:40:17 +01:00
Bernd Kuhls
2a77cd4858 package/tor: security bump version to 0.4.7.13
Changelog:
https://gitlab.torproject.org/tpo/core/tor/-/blob/main/ChangeLog?expanded=true&viewer=simple

Fixes CVE-2023-23589 aka TROVE-2022-002:
https://gitlab.torproject.org/tpo/core/tor/-/issues/40730

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit beeb4a2aad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:31:15 +01:00
Bernd Kuhls
a3f5889695 package/tor: bump version to 0.4.7.12
Changelog:
https://gitlab.torproject.org/tpo/core/tor/-/blob/main/ChangeLog?expanded=true&viewer=simple

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8b8c1f832b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:31:07 +01:00
Bernd Kuhls
e8d86b9a95 package/tor: bump version to 0.4.7.10
Release notes:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.7/ReleaseNotes

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit db15505180)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:30:52 +01:00
Christian Stewart
153a6ae28f package/docker-cli: bump version to 20.10.22
https://github.com/moby/moby/releases/tag/v20.10.22

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8e6fcd46fb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:28:13 +01:00
Christian Stewart
400edb09a8 package/docker-engine: bump version to 20.10.22
Bug fixes and enhancements

 - Improve error message when attempting to pull an unsupported image format or OCI artifact (moby/moby#44413, moby/moby#44569)
 - Fix an issue where the host's ephemeral port-range was ignored when selecting random ports for containers (moby/moby#44476).
 - Fix ssh: parse error in message type 27 errors during docker build on hosts using OpenSSH 8.9 or above (moby/moby#3862).
 - seccomp: block socket calls to AF_VSOCK in default profile (moby/moby#44564).

https://github.com/moby/moby/releases/tag/v20.10.22

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit de51efc543)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:28:11 +01:00
Peter Korsgaard
e1be0eb4be {linux, linux-headers}: bump 4.9.x / 5.{10, 15}.x / 6.{0, 1}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 479b042433)
[Peter: drop 6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:25:54 +01:00
Fabrice Fontaine
82a504e9fe package/libpjsip: security bump to version 2.13
- Fix CVE-2022-39269, CVE-2022-39244 and CVE-2022-31031:
  https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg
  https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
  https://github.com/pjsip/pjproject/security/advisories/GHSA-26j7-ww69-c4qj
- Drop patch (already in version)
- libuuid configure option is available since
  0b0488f17b
- libupnp is an optional dependency since
  82247cb8c0
- libsrtp is optional since
  fe6cbbc397

https://github.com/pjsip/pjproject/releases/tag/2.13

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cbc80c7557)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:16:34 +01:00
Lang Daniel
d37575c229 DEVELOPERS: add Daniel Lang for package/libsigc
Signed-off-by: Daniel Lang <d.lang@abatec.at>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 189543e4ab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:13:19 +01:00
Bartosz Golaszewski
517a6a4115 DEVELOPERS: remove Bartosz Golaszewski
It's been a while since I've even used buildroot at all and I don't
really have any spare cycles to spend on maintaining its packages.
Let's face reality and drop me from the DEVELOPERS file.

Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 24c532c9f6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-15 21:03:21 +01:00
Nevo Hed
ba59c92c9d Makefile: fix use of many br2-external trees
The top level Makefile in buildroot has a recursive rule which causes
the appearance of a hang as the number of directories in BR2_EXTERNAL
increases. When the number of directories in BR2_EXTERNAL is small, the
recursion occurs, but make detects the recursion and determines the
target does not have to be remade. This allows make to progress.

This is the failing rule:

    define percent_defconfig
    # Override the BR2_DEFCONFIG from COMMON_CONFIG_ENV with the new defconfig
    %_defconfig: $(BUILD_DIR)/buildroot-config/conf $(1)/configs/%_defconfig outputmakefile
        @$$(COMMON_CONFIG_ENV) BR2_DEFCONFIG=$(1)/configs/$$@ \
                $$< --defconfig=$(1)/configs/$$@ $$(CONFIG_CONFIG_IN)
    endef
    $(eval $(foreach d,$(call reverse,$(TOPDIR) $(BR2_EXTERNAL_DIRS)),$(call percent_defconfig,$(d))$(sep)))

The rule for %defconfig is created for each directory in BR2_EXTERNAL.
When the rule is matched, the stem is 'defconfig_name'. The second
prerequisite is expanded to $(1)/configs/defconfig_name_defconfig. The
rule, and all of the other rules defined by this macro, are invoked
again, but the stem is now $(1)/configs/defconfig_name_defconfig. The
second prerequisite is now expanded to
$(1)/configs/($1)/configs/defconfig_name_defconfig. This expansion
continues until make detects the infinite recursion.

With up to 5 br2-external trees, the time is very small, so that it is
not noticeable. But starting with 6 br2-external trees, the time is
insanely big (so much so that we did not even let it finish after it ran
for hours); see timings toward the end of the commit log.

We fix that by adding a single %_defconfig rule, which is now rsponsible
to find the actual defconfig file that triggered the rule, by iterating
on the reverse list of br2-external trees and then in main tree.

Of course, now, there is no way for make to warn that there is no such
defconfig, as it is no longer part of the prerequisites of the rule. So,
we delegate to the recipe the responsibility to check for that.

Timing (seconds) of `make pc_x86_64_bios_defconfig` with 1..1000
external trees, with make 4.2.1 (* with make 4.3), on a Core i7-7700HQ:

    #trees    Before    After
         1     0.312    0.319
         2     0.319    0.323
         3     0.325    0.327
         4     0.353    0.339
         5     0.993    0.349
         6     1.26*    0.347
         7     9.10*    0.362
         8    85.93*    0.360
         9     n/a      0.373
        10     n/a      0.374
        50     n/a      0.738
       100     n/a      1.228
       500     n/a      7.483
      1000     n/a     16.076

How to reproduce:

    #!/usr/bin/env bash

    N="${1:-1000}"

    for i in $(seq 1 1000); do
        [ -d "br2-external/${i}/configs" ] && break
        mkdir -p br2-external/${i}/configs
        touch br2-external/${i}/{Config.in,external.mk}
        echo "name: BR_TEST_${i}" >br2-external/${i}/external.desc
        touch br2-external/${i}/configs/foo{,_${i}}_defconfig
    done

    time make \
        BR2_EXTERNAL="$(
            for i in $(seq 1 ${N}); do
                printf '%s\n' "$(pwd)/br2-external/${i}"
            done
        )" \
        foo_1_defconfig

Notes: the timings are very dependent on how much the CPU is otherwise
loaded, but having a multi-core CPU slightly loaded helps maintain a
high frequency on the siblings, and that can reduce the above timings
in half! Best to try on an otherwise-idle system.

Fixes: #14996

Reported-by: David Lawson <david.lawson1@tx.rr.com>
Signed-off-by: Nevo Hed <nhed+buildroot@starry.com>
[yann.morin.1998@free.fr:
  - split long foreach
  - drastically extend the commit log
  - provide reproducer script and redo timings
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e6195c5304)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-12 11:20:09 +01:00
Fabrice Fontaine
4418e34d72 package/wireshark: add libcap optional dependency
libcap is an optional dependency which is enabled by default since at
least version 1.8.0 and
9250a69a99

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f70149c80c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 20:42:53 +01:00
Fabrice Fontaine
be417b433d package/wireshark: add zlib optional dependency
zlib is an optional dependency which is enabled by default since at
least version 1.8.0 and
7133f6944d

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e6365126e7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 20:41:01 +01:00
Fabrice Fontaine
847c45a8d3 package/tiff: fix host package
Disable webp and zstd on host package to avoid the following build
failure with host-gdk-pixbuf raised since bump to version 4.5.0 in
commit 5b62ea0136:

Run-time dependency libtiff-4 found: NO (tried cmake)

../output-1/build/host-gdk-pixbuf-2.42.10/meson.build:330:2: ERROR: Dependency lookup for libtiff-4 with method 'pkgconfig' failed: Could not generate cargs for libtiff-4:
Package libwebp was not found in the pkg-config search path.
Perhaps you should add the directory containing `libwebp.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libwebp', required by 'libtiff-4', not found

[...]

Run-time dependency libtiff-4 found: NO (tried cmake)

../output-1/build/host-gdk-pixbuf-2.42.10/meson.build:330:2: ERROR: Dependency lookup for libtiff-4 with method 'pkgconfig' failed: Could not generate cargs for libtiff-4:
Package libzstd was not found in the pkg-config search path.
Perhaps you should add the directory containing `libzstd.pc'
to the PKG_CONFIG_PATH environment variable
Package 'libzstd', required by 'libtiff-4', not found

While at it, also disable libdeflate even if no build failures are
raised by autobuilders

Fixes:
 - http://autobuild.buildroot.org/results/320083dfec4d126043b036cbaec7c7b85069a50a
 - http://autobuild.buildroot.org/results/8ff1cfa254920749a43e235c4084b8524d0edf6f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 84e52a60b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 20:40:00 +01:00
Bernd Kuhls
b9026d539e package/php: security bump version to 8.0.27
Release notes: https://www.php.net/releases/8_0_27.php
Changelog: https://www.php.net/ChangeLog-8.php#8.0.27

Fixes CVE-2022-31631: http://bugs.php.net/81740

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:49:47 +01:00
Ricardo Martincoski
05900e5b6e package/gobject-introspection: really use host python for host variant
Commit "abc110e362 package/gobject-introspection: bump to version
1.68.0" renamed the define that makes sure g-ir-tool-template uses the
host python, but forgot to update its call on pre-configure hooks.

Update it now.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 80c5be77ce)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:48:31 +01:00
Fabrice Fontaine
b96bf0a106 package/check: disable doc
documentation can be disabled since version 0.13.0 and
8ca1f79a73

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d7d48b9840)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:41:06 +01:00
Bernd Kuhls
615c2b690e package/x11r7/xserver_xorg-server: bump version to 21.1.6
Fixes a regression in XTestSwapFakeInput() introduced in the fix for
CVE-2022-46340 in 21.1.5.

Removed patches included in upstream release.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Peter: mention regression fix]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 60b4b04dc2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:39:06 +01:00
Ricardo Martincoski
a8afd5e69d package/checkpolicy: drop bogus CHECKPOLICY_STAGING_CMDS
Commit "b06110621d checkpolicy: allow compiling for target" contains a
typo that prevents installing to staging. It also forgot to enable
CHECKPOLICY_INSTALL_STAGING.

But the package does not install headers or libraries, only ELF and
manual files.
So instead of fixing the install to staging, drop the bogus
CHECKPOLICY_STAGING_CMDS.

Cc: Clayton Shotwell <clayton.shotwell@collins.com>
Cc: Matt Weber <matthew.weber@collins.com>
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 14956d8908)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:30:46 +01:00
Ricardo Martincoski
0bd18549c8 package/wpa_supplicant: drop dangling WPA_SUPPLICANT_{LDFLAGS, MAKE_ENV}
Commit "0340b45da0 wpa_supplicant: bump to version 1.0" from 2012
converted the package to use the generic infra, but added a bogus
WPA_SUPPLICANT_LDFLAGS end left a dangling WPA_SUPPLICANT_MAKE_ENV.

Drop the symbols that are not used since 2012.

Cc: Matt Weber <matthew.weber@collins.com>
Cc: Sergey Matyukevich <geomatsi@gmail.com>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 11479db32c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:25:05 +01:00
Ricardo Martincoski
1b9afbd64f package/swupdate: drop dangling SWUPDATE_BUILD_CONFIG
"6c63e4de4a boot/swupdate: don't specify .config to munge" dropped all
usages of this define but the define itself was left dangling.

Drop it now.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ca5cd8d675)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:24:44 +01:00
Ricardo Martincoski
1eef77e582 package/rhash: drop dangling RHASH_ADDLDFLAGS
Commit "ead2afda13 package/rhash: bump version to 1.4.0" dropped the
only usage of this define but the define itself was left dangling.

Drop it now.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit eae97036f3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:23:54 +01:00
Ricardo Martincoski
12681ecacf package/qoriq-rcw: drop bogus QORIQ_RCW_FILE_BIN
While applying [1] and cleaning up, the commit "d167f7006e
package/qoriq-rcw: add in-tree rcw source support" ended up keeping an
unused define.

Drop it now.

[1] http://patchwork.ozlabs.org/project/buildroot/patch/20200207083857.28058-4-jerry.huang@nxp.com/

Cc: Matt Weber <matthew.weber@collins.com>
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 41aa369d01)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:23:28 +01:00
Ricardo Martincoski
b6e119bb55 package/policycoreutils: drop bogus INSTALL_TARGET_LINUX_PAM_CONFS
Commit "cb328f77f8 policycoreutils: new package" added a define that is
never called: POLICYCOREUTILS_INSTALL_TARGET_LINUX_PAM_CONFS.

The build system from the package already install these files to target.
So just drop the bogus define.

Cc: Clayton Shotwell <clayton.shotwell@collins.com>
Cc: Matt Weber <matthew.weber@collins.com>
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9a4e154c9c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:22:21 +01:00
Ricardo Martincoski
e5f0b65f1f package/lrzsz: drop bogus LRZSZ_BUILD_HOOKS
Commit "4f3f291a3b lrzsz: convert to autotools infrastructure" converted
the package to use autotools infra but added a define that is never
called.

Drop the bogus define.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5fde4abc8d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-01-11 10:22:14 +01:00